mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
20 lines
1.5 KiB
YAML
20 lines
1.5 KiB
YAML
name: Windows Event Log Security 4727
|
|
id: 4d2078ab-36f5-447e-b7e4-474890b8040b
|
|
version: 3
|
|
creation_date: '2025-02-21'
|
|
modification_date: '2026-05-13'
|
|
author: Bhavin Patel, Splunk
|
|
description: Data source object for Windows Event Log Security 4727
|
|
source: XmlWinEventLog:Security
|
|
sourcetype: XmlWinEventLog
|
|
separator: EventCode
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Windows
|
|
url: https://splunkbase.splunk.com/app/742
|
|
version: 10.0.1
|
|
fields:
|
|
- _time
|
|
output_fields:
|
|
- dest
|
|
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4727</EventID><Version>0</Version><Level>0</Level><Task>13826</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-30T16:51:45.175123800Z'/><EventRecordID>183204880</EventRecordID><Correlation/><Execution ProcessID='672' ThreadID='3064'/><Channel>Security</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='TargetUserName'>ESX Admins</Data><Data Name='TargetDomainName'>ATTACKRANGE</Data><Data Name='TargetSid'>ATTACKRANGE\ESX Admins</Data><Data Name='SubjectUserSid'>ATTACKRANGE\Administrator</Data><Data Name='SubjectUserName'>administrator</Data><Data Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0xe32f0</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>ESX Admins</Data><Data Name='SidHistory'>-</Data></EventData></Event>
|