pC_raw46731.md

Parser Content

{
Name = raw-4673-1
  Vendor = Microsoft
  Product = Windows
  Lms = Direct
  DataType = "windows-privileged-access"
  TimeFormat = "MMM dd HH:mm:ss yyyy"
  Conditions = ["A privileged service was called", "Privileges", "Account Name:"]
  Fields = [
    """exabeam_host=([^=]{1,2000}?@\s{0,100})?({host}[\w.-]{1,2000})""",
    """exabeam_time=({time}\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d)""",
    """({event_name}A privileged service was called)""",
    """\s\d\d:\d\d:\d\d\s({host}[^\s]{1,2000})\s""",
    """({time}\w+\s{1,100}\d{1,100}\s{1,100}\d{1,100}:\d{1,100}:\d{1,100}\s{1,100}\d{1,100})\s{1,100}4673""",
    """(?i)\w+\s{0,100}\d{1,100}\s{0,100}\d{1,100}:\d{1,100}:\d{1,100}\s{1,100}(::ffff:)?(({dest_ip}\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(am|pm|({dest_host}[\w\-.]{1,2000})))""",
    """:\d{2}\s{1,100}({host}[\w.-]{1,2000})\s{1,100}(?i)((audit|success|failure)( |_)(success|audit|failure))\s{1,100}4673""",
    """({outcome}(?i)(((audit|success|failure)( |_)(success|audit|failure))|information))\s{0,100}(\s|\t|,|#\d{1,100}|<[^>]{1,2000}>)\s{0,100}(4673|({host}(({dest_ip}(\d{1,3}\.){3}\d{1,3})|({dest_host}[\w\-\.]{1,2000}))))\s{0,100}(\s|\t|,|#\d{1,100}|<[^>]{1,2000}>)\s{0,100}""",
    """({event_code}4673)""",
    """Process Name:\s{0,100}(?: |({process}({directory}(?:[^";]{1,2000})?[\\\/])?({process_name}[^\\\/";]{1,2000}?)))[\s;]{0,2000}Service Request Information:""",
    """Account Name:\s{0,100}({user}[^:]{1,2000}?)\s{0,100}Account Domain:""",
    """Account Domain:\s{0,100}({domain}[^:]{1,2000}?)\s{0,100}Logon ID:""",
    """Logon ID:\s{0,100}({logon_id}[^:]{1,2000}?)\s{0,100}Service:""",
    """Server:\s{0,100}({object_server}[^:]{1,2000}?)\s{0,100}Service Name:""",
    """Privileges:\s{0,100}({privileges}[^$]{1,2000}?)(\s{0,100}$|\s{1,100}\d{1,100}|\\?"|,|;|\s{0,100}(xml=)?<)"""
    """Service Name:\s{0,100}(-|({service_name}[^\\\s]{1,2000}?))\s{0,100}\w+:""" 
  ]
  DupFields = ["directory->process_directory"]


}