Skip to content

Commit 09ba6c1

Browse files
efd6efd6
authored
windows/forwarded: add support for events 4674, 4738 and 4742 (#3945)
Logic for the "Decode message table" processor is ported from the same processor in the system/security data stream added in bc44f65.
1 parent 0466f23 commit 09ba6c1

File tree

11 files changed

+1726
-984
lines changed

11 files changed

+1726
-984
lines changed

‎packages/windows/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.15.0"
3+
changes:
4+
- description: Add support for events 4674, 4738 and 4742.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/3945
27
- version: "1.14.1"
38
changes:
49
- description: Fix translate_sid processor error in powershell operational data stream.

‎packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-4674.json‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2021-11-11T17:14:52.001Z",
5+
"agent": {
6+
"name": "AgentName",
7+
"type": "filebeat",
8+
"version": "7.15.2",
9+
"hostname": "hostname",
10+
"ephemeral_id": "8c285603-b2ba-4891-8f1a-862ca3388614",
11+
"id": "7d1ef343-9372-428d-bd10-0a78e6894797"
12+
},
13+
"winlog": {
14+
"time_created": "2015-10-09T00:22:36.237Z",
15+
"event_id": "4674",
16+
"provider_name": "Microsoft-Windows-Security-Auditing",
17+
"keywords": [
18+
"Audit Failure"
19+
],
20+
"opcode": "Info",
21+
"outcome": "failure",
22+
"level": "information",
23+
"event_data": {
24+
"ProcessId": "0x1f0",
25+
"SubjectDomainName": "NT AUTHORITY",
26+
"SubjectLogonId": "0x3e5",
27+
"ObjectType": "-",
28+
"ObjectName": "-",
29+
"AccessMask": "16777216",
30+
"PrivilegeList": "SeSecurityPrivilege",
31+
"ProcessName": "C:\\\\Windows\\\\System32\\\\lsass.exe",
32+
"SubjectUserSid": "S-1-5-19",
33+
"SubjectUserName": "LOCAL SERVICE",
34+
"ObjectServer": "LSA",
35+
"HandleId": "0x0"
36+
},
37+
"process": {
38+
"pid": 496,
39+
"thread": {
40+
"id": 504
41+
}
42+
},
43+
"channel": "Security",
44+
"record_id": 1099680,
45+
"computer_name": "DC01.contoso.local",
46+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"
47+
},
48+
"event": {
49+
"code": "4674",
50+
"kind": "event",
51+
"provider": "Microsoft-Windows-Security-Auditing",
52+
"outcome": "failure"
53+
},
54+
"log": {
55+
"file": {
56+
"path": "/file/path/4674.xml"
57+
},
58+
"level": "information"
59+
},
60+
"message": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Security-Auditing\" Guid=\"{54849625-5478-4994-A5BA-3E3B0328C30D}\" /\u003e\u003cEventID\u003e4674\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e0\u003c/Level\u003e\u003cTask\u003e13056\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8010000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2015-10-09T00:22:36.237816000Z\" /\u003e\u003cEventRecordID\u003e1099680\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"496\" ThreadID=\"504\" /\u003e\u003cChannel\u003eSecurity\u003c/Channel\u003e\u003cComputer\u003eDC01.contoso.local\u003c/Computer\u003e\u003cSecurity /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"SubjectUserSid\"\u003eS-1-5-19\u003c/Data\u003e\u003cData Name=\"SubjectUserName\"\u003eLOCAL SERVICE\u003c/Data\u003e\u003cData Name=\"SubjectDomainName\"\u003eNT AUTHORITY\u003c/Data\u003e\u003cData Name=\"SubjectLogonId\"\u003e0x3e5\u003c/Data\u003e\u003cData Name=\"ObjectServer\"\u003eLSA\u003c/Data\u003e\u003cData Name=\"ObjectType\"\u003e-\u003c/Data\u003e\u003cData Name=\"ObjectName\"\u003e-\u003c/Data\u003e\u003cData Name=\"HandleId\"\u003e0x0\u003c/Data\u003e\u003cData Name=\"AccessMask\"\u003e16777216\u003c/Data\u003e\u003cData Name=\"PrivilegeList\"\u003eSeSecurityPrivilege\u003c/Data\u003e\u003cData Name=\"ProcessId\"\u003e0x1f0\u003c/Data\u003e\u003cData Name=\"ProcessName\"\u003eC:\\\\Windows\\\\System32\\\\lsass.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e",
61+
"input": {
62+
"type": "log"
63+
},
64+
"ecs": {
65+
"version": "1.11.0"
66+
},
67+
"host": {
68+
"name": "DC01.contoso.local"
69+
}
70+
},
71+
{
72+
"@timestamp": "2021-11-11T17:14:53.001Z",
73+
"event": {
74+
"action": "Sensitive Privilege Use",
75+
"code": "4674",
76+
"kind": "event",
77+
"outcome": "success",
78+
"provider": "Microsoft-Windows-Security-Auditing"
79+
},
80+
"host": {
81+
"name": "DC_TEST2k12.TEST.SAAS"
82+
},
83+
"log": {
84+
"level": "information"
85+
},
86+
"message": "An operation was attempted on a privileged object.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-2794\n\tAccount Name:\t\tat_adm\n\tAccount Domain:\t\tTEST\n\tLogon ID:\t\t0x5E2887\n\nObject:\n\tObject Server:\tSecurity\n\tObject Type:\tFile\n\tObject Name:\tC:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PLA\\Server Manager Performance Monitor\n\tObject Handle:\t0x1684\n\nProcess Information:\n\tProcess ID:\t0x3e4\n\tProcess Name:\tC:\\Windows\\System32\\svchost.exe\n\nRequested Operation:\n\tDesired Access:\tREAD_CONTROL\n\t\t\t\tACCESS_SYS_SEC\n\n\tPrivileges:\t\tSeSecurityPrivilege",
87+
"winlog": {
88+
"channel": "Security",
89+
"computer_name": "DC_TEST2k12.TEST.SAAS",
90+
"event_data": {
91+
"AccessMask": "%%1538\n\t\t\t\t%%1542\n\t\t\t\t",
92+
"HandleId": "0x1684",
93+
"ObjectName": "C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PLA\\Server Manager Performance Monitor",
94+
"ObjectServer": "Security",
95+
"ObjectType": "File",
96+
"PrivilegeList": "SeSecurityPrivilege",
97+
"ProcessId": "0x3e4",
98+
"ProcessName": "C:\\Windows\\System32\\svchost.exe",
99+
"SubjectDomainName": "TEST",
100+
"SubjectLogonId": "0x5e2887",
101+
"SubjectUserName": "at_adm",
102+
"SubjectUserSid": "S-1-5-21-1717121054-434620538-60925301-2794"
103+
},
104+
"event_id": "4674",
105+
"keywords": [
106+
"Audit Success"
107+
],
108+
"level": "information",
109+
"opcode": "Info",
110+
"outcome": "success",
111+
"process": {
112+
"pid": 604,
113+
"thread": {
114+
"id": 612
115+
}
116+
},
117+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
118+
"provider_name": "Microsoft-Windows-Security-Auditing",
119+
"record_id": 18232147,
120+
"task": "Sensitive Privilege Use",
121+
"time_created": "2022-08-01T08:53:50.3336583Z"
122+
}
123+
}
124+
]
125+
}

‎packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-4674.json-expected.json‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2015-10-09T00:22:36.237Z",
5+
"agent": {
6+
"ephemeral_id": "8c285603-b2ba-4891-8f1a-862ca3388614",
7+
"hostname": "hostname",
8+
"id": "7d1ef343-9372-428d-bd10-0a78e6894797",
9+
"name": "AgentName",
10+
"type": "filebeat",
11+
"version": "7.15.2"
12+
},
13+
"ecs": {
14+
"version": "8.0.0"
15+
},
16+
"event": {
17+
"action": "privileged-operation",
18+
"category": [
19+
"iam"
20+
],
21+
"code": "4674",
22+
"kind": "event",
23+
"outcome": "failure",
24+
"provider": "Microsoft-Windows-Security-Auditing",
25+
"type": [
26+
"admin"
27+
]
28+
},
29+
"host": {
30+
"name": "DC01.contoso.local"
31+
},
32+
"input": {
33+
"type": "log"
34+
},
35+
"log": {
36+
"file": {
37+
"path": "/file/path/4674.xml"
38+
},
39+
"level": "information"
40+
},
41+
"message": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Security-Auditing\" Guid=\"{54849625-5478-4994-A5BA-3E3B0328C30D}\" /\u003e\u003cEventID\u003e4674\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e0\u003c/Level\u003e\u003cTask\u003e13056\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8010000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2015-10-09T00:22:36.237816000Z\" /\u003e\u003cEventRecordID\u003e1099680\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"496\" ThreadID=\"504\" /\u003e\u003cChannel\u003eSecurity\u003c/Channel\u003e\u003cComputer\u003eDC01.contoso.local\u003c/Computer\u003e\u003cSecurity /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"SubjectUserSid\"\u003eS-1-5-19\u003c/Data\u003e\u003cData Name=\"SubjectUserName\"\u003eLOCAL SERVICE\u003c/Data\u003e\u003cData Name=\"SubjectDomainName\"\u003eNT AUTHORITY\u003c/Data\u003e\u003cData Name=\"SubjectLogonId\"\u003e0x3e5\u003c/Data\u003e\u003cData Name=\"ObjectServer\"\u003eLSA\u003c/Data\u003e\u003cData Name=\"ObjectType\"\u003e-\u003c/Data\u003e\u003cData Name=\"ObjectName\"\u003e-\u003c/Data\u003e\u003cData Name=\"HandleId\"\u003e0x0\u003c/Data\u003e\u003cData Name=\"AccessMask\"\u003e16777216\u003c/Data\u003e\u003cData Name=\"PrivilegeList\"\u003eSeSecurityPrivilege\u003c/Data\u003e\u003cData Name=\"ProcessId\"\u003e0x1f0\u003c/Data\u003e\u003cData Name=\"ProcessName\"\u003eC:\\\\Windows\\\\System32\\\\lsass.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e",
42+
"process": {
43+
"executable": "C:\\\\Windows\\\\System32\\\\lsass.exe",
44+
"name": "lsass.exe",
45+
"pid": 496
46+
},
47+
"related": {
48+
"user": [
49+
"LOCAL SERVICE"
50+
]
51+
},
52+
"user": {
53+
"domain": "NT AUTHORITY",
54+
"id": "S-1-5-19",
55+
"name": "LOCAL SERVICE"
56+
},
57+
"winlog": {
58+
"channel": "Security",
59+
"computer_name": "DC01.contoso.local",
60+
"event_data": {
61+
"AccessMask": "16777216",
62+
"AccessMaskDescription": [
63+
"ADS_RIGHT_ACCESS_SYSTEM_SECURITY"
64+
],
65+
"HandleId": "0x0",
66+
"ObjectName": "-",
67+
"ObjectServer": "LSA",
68+
"ObjectType": "-",
69+
"PrivilegeList": [
70+
"SeSecurityPrivilege"
71+
],
72+
"SubjectDomainName": "NT AUTHORITY",
73+
"SubjectLogonId": "0x3e5",
74+
"SubjectUserName": "LOCAL SERVICE",
75+
"SubjectUserSid": "S-1-5-19"
76+
},
77+
"event_id": "4674",
78+
"keywords": [
79+
"Audit Failure"
80+
],
81+
"level": "information",
82+
"logon": {
83+
"id": "0x3e5"
84+
},
85+
"opcode": "Info",
86+
"outcome": "failure",
87+
"process": {
88+
"pid": 496,
89+
"thread": {
90+
"id": 504
91+
}
92+
},
93+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
94+
"provider_name": "Microsoft-Windows-Security-Auditing",
95+
"record_id": "1099680",
96+
"time_created": "2015-10-09T00:22:36.237Z"
97+
}
98+
},
99+
{
100+
"@timestamp": "2022-08-01T08:53:50.333Z",
101+
"ecs": {
102+
"version": "8.0.0"
103+
},
104+
"event": {
105+
"action": "privileged-operation",
106+
"category": [
107+
"iam"
108+
],
109+
"code": "4674",
110+
"kind": "event",
111+
"outcome": "success",
112+
"provider": "Microsoft-Windows-Security-Auditing",
113+
"type": [
114+
"admin"
115+
]
116+
},
117+
"host": {
118+
"name": "DC_TEST2k12.TEST.SAAS"
119+
},
120+
"log": {
121+
"level": "information"
122+
},
123+
"message": "An operation was attempted on a privileged object.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-2794\n\tAccount Name:\t\tat_adm\n\tAccount Domain:\t\tTEST\n\tLogon ID:\t\t0x5E2887\n\nObject:\n\tObject Server:\tSecurity\n\tObject Type:\tFile\n\tObject Name:\tC:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PLA\\Server Manager Performance Monitor\n\tObject Handle:\t0x1684\n\nProcess Information:\n\tProcess ID:\t0x3e4\n\tProcess Name:\tC:\\Windows\\System32\\svchost.exe\n\nRequested Operation:\n\tDesired Access:\tREAD_CONTROL\n\t\t\t\tACCESS_SYS_SEC\n\n\tPrivileges:\t\tSeSecurityPrivilege",
124+
"process": {
125+
"executable": "C:\\Windows\\System32\\svchost.exe",
126+
"name": "svchost.exe",
127+
"pid": 996
128+
},
129+
"related": {
130+
"user": [
131+
"at_adm"
132+
]
133+
},
134+
"user": {
135+
"domain": "TEST",
136+
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
137+
"name": "at_adm"
138+
},
139+
"winlog": {
140+
"channel": "Security",
141+
"computer_name": "DC_TEST2k12.TEST.SAAS",
142+
"event_data": {
143+
"AccessMask": "%%1538\n\t\t\t\t%%1542\n\t\t\t\t",
144+
"AccessMaskDescription": [
145+
"Delete Child",
146+
"List Contents"
147+
],
148+
"HandleId": "0x1684",
149+
"ObjectName": "C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PLA\\Server Manager Performance Monitor",
150+
"ObjectServer": "Security",
151+
"ObjectType": "File",
152+
"PrivilegeList": [
153+
"SeSecurityPrivilege"
154+
],
155+
"SubjectDomainName": "TEST",
156+
"SubjectLogonId": "0x5e2887",
157+
"SubjectUserName": "at_adm",
158+
"SubjectUserSid": "S-1-5-21-1717121054-434620538-60925301-2794"
159+
},
160+
"event_id": "4674",
161+
"keywords": [
162+
"Audit Success"
163+
],
164+
"level": "information",
165+
"logon": {
166+
"id": "0x5e2887"
167+
},
168+
"opcode": "Info",
169+
"outcome": "success",
170+
"process": {
171+
"pid": 604,
172+
"thread": {
173+
"id": 612
174+
}
175+
},
176+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
177+
"provider_name": "Microsoft-Windows-Security-Auditing",
178+
"record_id": "18232147",
179+
"task": "Sensitive Privilege Use",
180+
"time_created": "2022-08-01T08:53:50.3336583Z"
181+
}
182+
}
183+
]
184+
}

‎packages/windows/data_stream/forwarded/_dev/test/pipeline/test-security-4738.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2021-11-11T17:14:52.001Z",
5+
"event": {
6+
"action": "User Account Management",
7+
"code": "4738",
8+
"kind": "event",
9+
"outcome": "success",
10+
"provider": "Microsoft-Windows-Security-Auditing"
11+
},
12+
"host": {
13+
"name": "DC_TEST2k12"
14+
},
15+
"log": {
16+
"level": "information"
17+
},
18+
"message": "A user account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-2794\n\tAccount Name:\t\tat_adm\n\tAccount Domain:\t\tTEST\n\tLogon ID:\t\t0x5E2887\n\nTarget Account:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-8884\n\tAccount Name:\t\tanatest1\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\tanatest12@TEST\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t-\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-",
19+
"winlog": {
20+
"channel": "Security",
21+
"computer_name": "DC_TEST2k12",
22+
"event_data": {
23+
"AccountExpires": "-",
24+
"AllowedToDelegateTo": "-",
25+
"DisplayName": "-",
26+
"Dummy": "-",
27+
"HomeDirectory": "-",
28+
"HomePath": "-",
29+
"LogonHours": "-",
30+
"NewUacValue": "-",
31+
"OldUacValue": "-",
32+
"PasswordLastSet": "-",
33+
"PrimaryGroupId": "-",
34+
"PrivilegeList": "-",
35+
"ProfilePath": "-",
36+
"SamAccountName": "-",
37+
"ScriptPath": "-",
38+
"SidHistory": "-",
39+
"SubjectDomainName": "TEST",
40+
"SubjectLogonId": "0x5e2887",
41+
"SubjectUserName": "at_adm",
42+
"SubjectUserSid": "S-1-5-21-1717121054-434620538-60925301-2794",
43+
"TargetDomainName": "TEST",
44+
"TargetSid": "S-1-5-21-1717121054-434620538-60925301-8884",
45+
"TargetUserName": "anatest1",
46+
"UserAccountControl": "-",
47+
"UserParameters": "-",
48+
"UserPrincipalName": "anatest12@TEST",
49+
"UserWorkstations": "-"
50+
},
51+
"event_id": "4738",
52+
"keywords": [
53+
"Audit Success"
54+
],
55+
"level": "information",
56+
"opcode": "Info",
57+
"outcome": "success",
58+
"process": {
59+
"pid": 604,
60+
"thread": {
61+
"id": 864
62+
}
63+
},
64+
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
65+
"provider_name": "Microsoft-Windows-Security-Auditing",
66+
"record_id": 18232108,
67+
"task": "User Account Management",
68+
"time_created": "2022-08-01T08:49:58.8259888Z"
69+
}
70+
}
71+
]
72+
}

0 commit comments

Comments
 (0)