pC_raw46732.md

Parser Content

{
Name = raw-4673-2
  Vendor = Microsoft
  Product = Windows
  Lms = Direct
  DataType = "windows-privileged-access"
  TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
  Conditions = [ """Microsoft-Windows-Security-Auditing""", """PrivilegeList:""", """4673""", """ObjectServer:""", """Sensitive Privilege Use""" ]
  Fields = [
    """({time}\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d)\.\d{1,3}[+\-]{1,20}\d\d:\d\d""",
    """({host}[^\s]{1,2000})\s{1,100}Sensitive Privilege Use""",
    """({event_code}4673)""",
    """SubjectUserName:({user}[^,]{1,2000}),""",
    """SubjectDomainName:({domain}[^,]{1,2000}),""",
    """SubjectLogonId:({logon_id}[^,]{1,2000}),""",
    """PrivilegeList:({privileges}[^:]{1,2000}),\s{1,100}\w+:""",
    """ProcessId:({pid}[^,]{1,2000}),""",
    """ProcessName:({process}(({directory}[^"]{1,2000})[\\\/])?({process_name}[^"\\]{1,2000}?))\s{1,100}\d{1,100}""",
    """({outcome}(Success|Failure) Audit)"""
  ]


}