{"timestamp":"2022-12-06T00:01:01.714+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284861.722","full_log":"type=CRED_REFR msg=audit(1670284861.060:21945): pid=32626 uid=0 auid=0 ses=3033 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21945","pid":"32626","uid":"0","auid":"0","session":"3033","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:01:01.714+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284861.722","full_log":"type=USER_START msg=audit(1670284861.060:21944): pid=32626 uid=0 auid=0 ses=3033 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21944","pid":"32626","uid":"0","auid":"0","session":"3033","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:01:01.714+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284861.722","full_log":"type=USER_END msg=audit(1670284861.096:21947): pid=32626 uid=0 auid=0 ses=3033 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21947","pid":"32626","auid":"0","uid":"0","session":"3033","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:01:01.714+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284861.722","full_log":"type=CRED_DISP msg=audit(1670284861.094:21946): pid=32626 uid=0 auid=0 ses=3033 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21946","pid":"32626","auid":"0","uid":"0","session":"3033","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:01:01.714+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284861.722","full_log":"type=CRED_ACQ msg=audit(1670284861.037:21942): pid=32626 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21942","pid":"32626","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:01:01.714+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284861.722","full_log":"type=LOGIN msg=audit(1670284861.038:21943): pid=32626 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3033 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21943","pid":"32626","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:01:01.714+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284861.722","full_log":"type=USER_ACCT msg=audit(1670284861.036:21941): pid=32626 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21941","pid":"32626","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:02:17.788+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284937.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:02:17.787+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284937.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:02:17.788+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284937.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:02:17.788+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284937.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:02:17.788+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284937.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778180  44629120      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:02:17.787+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284937.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:02:17.792+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670284937.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 23:56 (17+13:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:02 (17+13:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 23:56 (17+13:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:04:02.488+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285042.722","full_log":"{\"type\":\"summary\",\"scan_id\":1191800111,\"name\":\"CIS Benchmark for CentOS 7\",\"policy_id\":\"cis_centos7_linux\",\"file\":\"cis_centos7_linux.yml\",\"description\":\"This document provides prescriptive guidance for establishing a secure configuration posture for CentOS 7 systems running on x86 and x64 platforms. This document was tested against CentOS 7.\",\"references\":\"https://www.cisecurity.org/cis-benchmarks/\",\"passed\":72,\"failed\":112,\"invalid\":12,\"total_checks\":196,\"score\":39.130435943603516,\"start_time\":1670285030,\"end_time\":1670285039,\"hash\":\"d8adf66d7f50543f2d05c88d7e4256d1b729c1a904629c61815f7c6adbe16829\",\"hash_file\":\"2ecc32ff7cb79fcf431211a3ec3496f8c441e6adf99c77295c00f830f63a02d9\"}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T00:04:02.499+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285042.722","full_log":"{\"type\":\"policies\",\"policies\":[\"cis_centos7_linux\"]}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T00:08:18.118+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285298.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:08:18.119+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285298.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:08:18.119+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285298.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:08:18.119+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285298.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:08:18.119+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285298.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:08:18.119+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285298.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778528  44628772      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:08:18.129+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285298.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:02 (17+13:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:08 (17+13:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:02 (17+13:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:10:02.239+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285402.722","full_log":"type=LOGIN msg=audit(1670285401.126:21950): pid=623 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3034 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21950","pid":"623","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:10:02.239+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285402.722","full_log":"type=CRED_ACQ msg=audit(1670285401.126:21949): pid=623 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21949","pid":"623","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:10:02.239+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285402.722","full_log":"type=USER_START msg=audit(1670285401.156:21951): pid=623 uid=0 auid=0 ses=3034 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21951","pid":"623","uid":"0","auid":"0","session":"3034","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:10:02.239+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285402.722","full_log":"type=CRED_REFR msg=audit(1670285401.157:21952): pid=623 uid=0 auid=0 ses=3034 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21952","pid":"623","uid":"0","auid":"0","session":"3034","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:10:02.239+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285402.722","full_log":"type=CRED_DISP msg=audit(1670285401.187:21953): pid=623 uid=0 auid=0 ses=3034 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21953","pid":"623","auid":"0","uid":"0","session":"3034","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:10:02.239+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285402.722","full_log":"type=USER_END msg=audit(1670285401.188:21954): pid=623 uid=0 auid=0 ses=3034 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21954","pid":"623","auid":"0","uid":"0","session":"3034","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:10:02.239+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285402.722","full_log":"type=USER_ACCT msg=audit(1670285401.125:21948): pid=623 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21948","pid":"623","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:14:18.489+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285658.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:14:18.489+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285658.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:14:18.489+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285658.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:14:18.489+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285658.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:14:18.489+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285658.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:14:18.489+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285658.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778716  44628584      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:14:18.494+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670285658.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:08 (17+13:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:14 (17+13:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:08 (17+13:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:20:02.804+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286002.722","full_log":"type=LOGIN msg=audit(1670286001.210:21957): pid=676 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3035 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21957","pid":"676","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:20:02.804+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286002.722","full_log":"type=USER_ACCT msg=audit(1670286001.209:21955): pid=676 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21955","pid":"676","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:20:02.804+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286002.722","full_log":"type=CRED_DISP msg=audit(1670286001.245:21960): pid=676 uid=0 auid=0 ses=3035 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21960","pid":"676","auid":"0","uid":"0","session":"3035","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:20:02.804+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286002.722","full_log":"type=CRED_REFR msg=audit(1670286001.224:21959): pid=676 uid=0 auid=0 ses=3035 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21959","pid":"676","uid":"0","auid":"0","session":"3035","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:20:02.804+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286002.722","full_log":"type=CRED_ACQ msg=audit(1670286001.209:21956): pid=676 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21956","pid":"676","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:20:02.804+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286002.722","full_log":"type=USER_END msg=audit(1670286001.246:21961): pid=676 uid=0 auid=0 ses=3035 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21961","pid":"676","auid":"0","uid":"0","session":"3035","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:20:02.804+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286002.722","full_log":"type=USER_START msg=audit(1670286001.224:21958): pid=676 uid=0 auid=0 ses=3035 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21958","pid":"676","uid":"0","auid":"0","session":"3035","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:20:18.835+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286018.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:20:18.835+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286018.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:20:18.835+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286018.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:20:18.835+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286018.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778532  44628768      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:20:18.835+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286018.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:20:18.835+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286018.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:20:18.850+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286018.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:14 (17+13:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:20 (17+13:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:14 (17+13:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:21:42.233+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286102.722","full_log":"Starting rootcheck scan.","decoder":{"name":"rootcheck"},"data":{"title":"Starting rootcheck scan."},"location":"rootcheck"}
{"timestamp":"2022-12-06T00:22:29.154+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286149.722","full_log":"Ending rootcheck scan.","decoder":{"name":"rootcheck"},"data":{"title":"Ending rootcheck scan."},"location":"rootcheck"}
{"timestamp":"2022-12-06T00:26:19.191+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286379.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:26:19.191+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286379.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:26:19.191+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286379.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:26:19.191+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286379.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:26:19.191+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286379.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:26:19.191+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286379.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776376  44630924      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:26:19.196+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286379.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:20 (17+13:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:26 (17+13:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:20 (17+13:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:30:01.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286601.722","full_log":"type=CRED_ACQ msg=audit(1670286601.284:21963): pid=1800 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21963","pid":"1800","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:30:01.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286601.722","full_log":"type=LOGIN msg=audit(1670286601.285:21964): pid=1800 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3036 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21964","pid":"1800","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:30:01.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286601.722","full_log":"type=USER_START msg=audit(1670286601.315:21965): pid=1800 uid=0 auid=0 ses=3036 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21965","pid":"1800","uid":"0","auid":"0","session":"3036","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:30:01.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286601.722","full_log":"type=CRED_REFR msg=audit(1670286601.315:21966): pid=1800 uid=0 auid=0 ses=3036 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21966","pid":"1800","uid":"0","auid":"0","session":"3036","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:30:01.433+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286601.722","full_log":"type=CRED_DISP msg=audit(1670286601.344:21967): pid=1800 uid=0 auid=0 ses=3036 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21967","pid":"1800","auid":"0","uid":"0","session":"3036","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:30:01.433+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286601.722","full_log":"type=USER_END msg=audit(1670286601.347:21968): pid=1800 uid=0 auid=0 ses=3036 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21968","pid":"1800","auid":"0","uid":"0","session":"3036","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:30:01.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286601.722","full_log":"type=USER_ACCT msg=audit(1670286601.284:21962): pid=1800 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21962","pid":"1800","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:32:19.589+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286739.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:32:19.591+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286739.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:32:19.591+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286739.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:32:19.591+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286739.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:32:19.591+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286739.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776516  44630784      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:32:19.591+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286739.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:32:19.594+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670286739.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:26 (17+13:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:32 (17+13:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:26 (17+13:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:38:19.914+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287099.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:38:19.914+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287099.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:38:19.914+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287099.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:38:19.914+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287099.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:38:19.914+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287099.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776556  44630744      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:38:19.914+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287099.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:38:19.928+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287099.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:32 (17+13:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:38 (17+13:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:32 (17+13:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:40:02.027+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287202.722","full_log":"type=USER_ACCT msg=audit(1670287201.367:21969): pid=1846 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21969","pid":"1846","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:40:02.027+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287202.722","full_log":"type=CRED_REFR msg=audit(1670287201.387:21973): pid=1846 uid=0 auid=0 ses=3037 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21973","pid":"1846","uid":"0","auid":"0","session":"3037","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:40:02.027+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287202.722","full_log":"type=USER_START msg=audit(1670287201.386:21972): pid=1846 uid=0 auid=0 ses=3037 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21972","pid":"1846","uid":"0","auid":"0","session":"3037","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:40:02.027+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287202.722","full_log":"type=LOGIN msg=audit(1670287201.367:21971): pid=1846 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3037 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21971","pid":"1846","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:40:02.027+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287202.722","full_log":"type=CRED_DISP msg=audit(1670287201.404:21974): pid=1846 uid=0 auid=0 ses=3037 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21974","pid":"1846","auid":"0","uid":"0","session":"3037","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:40:02.027+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287202.722","full_log":"type=USER_END msg=audit(1670287201.405:21975): pid=1846 uid=0 auid=0 ses=3037 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21975","pid":"1846","auid":"0","uid":"0","session":"3037","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:40:02.027+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287202.722","full_log":"type=CRED_ACQ msg=audit(1670287201.367:21970): pid=1846 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21970","pid":"1846","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:44:20.310+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287460.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:44:20.311+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287460.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:44:20.311+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287460.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:44:20.311+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287460.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776528  44630772      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:44:20.311+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287460.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:44:20.311+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287460.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:44:20.314+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287460.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:38 (17+13:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:44 (17+14:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:38 (17+13:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:50:02.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287802.722","full_log":"type=USER_ACCT msg=audit(1670287801.431:21976): pid=3390 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21976","pid":"3390","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:50:02.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287802.722","full_log":"type=USER_START msg=audit(1670287801.461:21979): pid=3390 uid=0 auid=0 ses=3038 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21979","pid":"3390","uid":"0","auid":"0","session":"3038","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:50:02.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287802.722","full_log":"type=CRED_ACQ msg=audit(1670287801.431:21977): pid=3390 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21977","pid":"3390","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:50:02.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287802.722","full_log":"type=CRED_DISP msg=audit(1670287801.487:21981): pid=3390 uid=0 auid=0 ses=3038 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21981","pid":"3390","auid":"0","uid":"0","session":"3038","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:50:02.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287802.722","full_log":"type=CRED_REFR msg=audit(1670287801.462:21980): pid=3390 uid=0 auid=0 ses=3038 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21980","pid":"3390","uid":"0","auid":"0","session":"3038","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:50:02.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287802.722","full_log":"type=USER_END msg=audit(1670287801.490:21982): pid=3390 uid=0 auid=0 ses=3038 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21982","pid":"3390","auid":"0","uid":"0","session":"3038","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:50:02.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287802.722","full_log":"type=LOGIN msg=audit(1670287801.432:21978): pid=3390 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3038 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21978","pid":"3390","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T00:50:20.692+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287820.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:50:20.692+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287820.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:50:20.692+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287820.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:50:20.692+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287820.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:50:20.692+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287820.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:50:20.692+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287820.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777596  44629704      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:50:20.697+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670287820.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:44 (17+14:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:50 (17+14:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:44 (17+14:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T00:56:21.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288181.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:56:21.060+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288181.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:56:21.060+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288181.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:56:21.060+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288181.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:56:21.060+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288181.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:56:21.060+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288181.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776956  44630344      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T00:56:21.059+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288181.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:50 (17+14:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:56 (17+14:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:50 (17+14:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:00:03.287+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288403.722","full_log":"type=LOGIN msg=audit(1670288401.507:21985): pid=3433 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3039 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21985","pid":"3433","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:00:03.287+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288403.722","full_log":"type=USER_START msg=audit(1670288401.522:21986): pid=3433 uid=0 auid=0 ses=3039 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21986","pid":"3433","uid":"0","auid":"0","session":"3039","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:00:03.287+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288403.722","full_log":"type=CRED_ACQ msg=audit(1670288401.507:21984): pid=3433 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21984","pid":"3433","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:00:03.287+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288403.722","full_log":"type=USER_END msg=audit(1670288401.537:21989): pid=3433 uid=0 auid=0 ses=3039 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21989","pid":"3433","auid":"0","uid":"0","session":"3039","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:00:03.287+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288403.722","full_log":"type=CRED_DISP msg=audit(1670288401.536:21988): pid=3433 uid=0 auid=0 ses=3039 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21988","pid":"3433","auid":"0","uid":"0","session":"3039","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:00:03.287+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288403.722","full_log":"type=CRED_REFR msg=audit(1670288401.522:21987): pid=3433 uid=0 auid=0 ses=3039 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21987","pid":"3433","uid":"0","auid":"0","session":"3039","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:00:03.287+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288403.722","full_log":"type=USER_ACCT msg=audit(1670288401.507:21983): pid=3433 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21983","pid":"3433","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:01:03.347+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288463.722","full_log":"type=USER_ACCT msg=audit(1670288461.557:21990): pid=3442 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21990","pid":"3442","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:01:03.347+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288463.722","full_log":"type=CRED_REFR msg=audit(1670288461.577:21994): pid=3442 uid=0 auid=0 ses=3040 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"21994","pid":"3442","uid":"0","auid":"0","session":"3040","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:01:03.347+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288463.722","full_log":"type=USER_START msg=audit(1670288461.577:21993): pid=3442 uid=0 auid=0 ses=3040 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"21993","pid":"3442","uid":"0","auid":"0","session":"3040","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:01:03.347+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288463.722","full_log":"type=CRED_ACQ msg=audit(1670288461.557:21991): pid=3442 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21991","pid":"3442","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:01:03.347+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288463.722","full_log":"type=USER_END msg=audit(1670288461.609:21996): pid=3442 uid=0 auid=0 ses=3040 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"21996","pid":"3442","auid":"0","uid":"0","session":"3040","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:01:03.347+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288463.722","full_log":"type=LOGIN msg=audit(1670288461.557:21992): pid=3442 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3040 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21992","pid":"3442","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:01:03.347+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288463.722","full_log":"type=CRED_DISP msg=audit(1670288461.607:21995): pid=3442 uid=0 auid=0 ses=3040 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"21995","pid":"3442","auid":"0","uid":"0","session":"3040","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:02:21.441+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288541.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:02:21.441+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288541.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:02:21.441+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288541.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:02:21.441+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288541.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:02:21.441+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288541.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776680  44630620      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:02:21.441+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288541.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:02:21.441+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288541.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:56 (17+14:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:02 (17+14:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 00:56 (17+14:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:08:21.753+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288901.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:08:21.753+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288901.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:08:21.753+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288901.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:08:21.753+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288901.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:08:21.753+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288901.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776636  44630664      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:08:21.753+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288901.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:08:21.767+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670288901.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:02 (17+14:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:08 (17+14:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:02 (17+14:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:10:01.870+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289001.722","full_log":"type=CRED_ACQ msg=audit(1670289001.641:21998): pid=3495 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"21998","pid":"3495","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:10:01.870+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289001.722","full_log":"type=USER_ACCT msg=audit(1670289001.641:21997): pid=3495 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"21997","pid":"3495","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:10:01.870+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289001.722","full_log":"type=USER_START msg=audit(1670289001.660:22000): pid=3495 uid=0 auid=0 ses=3041 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22000","pid":"3495","uid":"0","auid":"0","session":"3041","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:10:01.870+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289001.722","full_log":"type=CRED_REFR msg=audit(1670289001.661:22001): pid=3495 uid=0 auid=0 ses=3041 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22001","pid":"3495","uid":"0","auid":"0","session":"3041","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:10:01.870+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289001.722","full_log":"type=CRED_DISP msg=audit(1670289001.684:22002): pid=3495 uid=0 auid=0 ses=3041 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22002","pid":"3495","auid":"0","uid":"0","session":"3041","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:10:01.870+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289001.722","full_log":"type=LOGIN msg=audit(1670289001.642:21999): pid=3495 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3041 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"21999","pid":"3495","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:10:01.870+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289001.722","full_log":"type=USER_END msg=audit(1670289001.688:22003): pid=3495 uid=0 auid=0 ses=3041 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22003","pid":"3495","auid":"0","uid":"0","session":"3041","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:14:22.102+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289262.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:14:22.103+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289262.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:14:22.103+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289262.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:14:22.103+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289262.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:14:22.103+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289262.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:14:22.103+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289262.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777116  44630184      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:14:22.110+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289262.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:08 (17+14:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:14 (17+14:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:08 (17+14:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:20:02.436+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289602.722","full_log":"type=USER_ACCT msg=audit(1670289601.711:22004): pid=3549 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22004","pid":"3549","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:20:02.437+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289602.722","full_log":"type=CRED_DISP msg=audit(1670289601.750:22009): pid=3549 uid=0 auid=0 ses=3042 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22009","pid":"3549","auid":"0","uid":"0","session":"3042","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:20:02.437+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289602.722","full_log":"type=USER_END msg=audit(1670289601.752:22010): pid=3549 uid=0 auid=0 ses=3042 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22010","pid":"3549","auid":"0","uid":"0","session":"3042","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:20:02.437+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289602.722","full_log":"type=CRED_REFR msg=audit(1670289601.731:22008): pid=3549 uid=0 auid=0 ses=3042 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22008","pid":"3549","uid":"0","auid":"0","session":"3042","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:20:02.437+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289602.722","full_log":"type=USER_START msg=audit(1670289601.730:22007): pid=3549 uid=0 auid=0 ses=3042 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22007","pid":"3549","uid":"0","auid":"0","session":"3042","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:20:02.437+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289602.722","full_log":"type=LOGIN msg=audit(1670289601.712:22006): pid=3549 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3042 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22006","pid":"3549","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:20:02.436+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289602.722","full_log":"type=CRED_ACQ msg=audit(1670289601.712:22005): pid=3549 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22005","pid":"3549","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:20:22.468+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289622.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:20:22.468+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289622.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:20:22.468+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289622.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:20:22.468+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289622.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:20:22.468+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289622.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:20:22.468+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289622.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778772  44628528      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:20:22.491+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289622.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:14 (17+14:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:20 (17+14:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:14 (17+14:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:26:22.800+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289982.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:26:22.800+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289982.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:26:22.800+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289982.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:26:22.800+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289982.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7776736  44630564      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:26:22.800+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289982.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:26:22.800+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289982.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:26:22.814+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670289982.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:20 (17+14:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:26 (17+14:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:20 (17+14:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:30:03.036+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290203.722","full_log":"type=USER_ACCT msg=audit(1670290201.775:22011): pid=3593 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22011","pid":"3593","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:30:03.036+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290203.722","full_log":"type=CRED_ACQ msg=audit(1670290201.776:22012): pid=3593 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22012","pid":"3593","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:30:03.036+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290203.722","full_log":"type=LOGIN msg=audit(1670290201.776:22013): pid=3593 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3043 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22013","pid":"3593","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:30:03.036+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290203.722","full_log":"type=USER_START msg=audit(1670290201.793:22014): pid=3593 uid=0 auid=0 ses=3043 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22014","pid":"3593","uid":"0","auid":"0","session":"3043","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:30:03.036+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290203.722","full_log":"type=CRED_REFR msg=audit(1670290201.794:22015): pid=3593 uid=0 auid=0 ses=3043 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22015","pid":"3593","uid":"0","auid":"0","session":"3043","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:30:03.036+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290203.722","full_log":"type=CRED_DISP msg=audit(1670290201.816:22016): pid=3593 uid=0 auid=0 ses=3043 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22016","pid":"3593","auid":"0","uid":"0","session":"3043","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:30:03.036+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290203.722","full_log":"type=USER_END msg=audit(1670290201.819:22017): pid=3593 uid=0 auid=0 ses=3043 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22017","pid":"3593","auid":"0","uid":"0","session":"3043","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:32:23.189+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290343.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:32:23.189+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290343.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:32:23.189+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290343.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:32:23.189+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290343.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:32:23.189+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290343.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:32:23.189+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290343.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777044  44630256      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:32:23.205+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290343.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:26 (17+14:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:32 (17+14:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:26 (17+14:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:38:23.512+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290703.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:38:23.512+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290703.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:38:23.512+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290703.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:38:23.512+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290703.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:38:23.512+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290703.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777048  44630252      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:38:23.512+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290703.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:38:23.532+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290703.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:32 (17+14:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:38 (17+14:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:32 (17+14:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:40:03.593+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290803.722","full_log":"type=CRED_ACQ msg=audit(1670290801.842:22019): pid=3637 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22019","pid":"3637","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:40:03.593+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290803.722","full_log":"type=LOGIN msg=audit(1670290801.842:22020): pid=3637 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3044 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22020","pid":"3637","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:40:03.593+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290803.722","full_log":"type=CRED_REFR msg=audit(1670290801.860:22022): pid=3637 uid=0 auid=0 ses=3044 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22022","pid":"3637","uid":"0","auid":"0","session":"3044","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:40:03.593+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290803.722","full_log":"type=USER_START msg=audit(1670290801.860:22021): pid=3637 uid=0 auid=0 ses=3044 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22021","pid":"3637","uid":"0","auid":"0","session":"3044","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:40:03.593+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290803.722","full_log":"type=USER_ACCT msg=audit(1670290801.842:22018): pid=3637 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22018","pid":"3637","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:40:03.593+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290803.722","full_log":"type=CRED_DISP msg=audit(1670290801.874:22023): pid=3637 uid=0 auid=0 ses=3044 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22023","pid":"3637","auid":"0","uid":"0","session":"3044","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:40:03.593+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670290803.722","full_log":"type=USER_END msg=audit(1670290801.876:22024): pid=3637 uid=0 auid=0 ses=3044 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22024","pid":"3637","auid":"0","uid":"0","session":"3044","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:44:23.878+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291063.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:44:23.878+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291063.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:44:23.878+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291063.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777380  44629920      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:44:23.878+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291063.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:44:23.878+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291063.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:44:23.878+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291063.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:44:23.891+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291063.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:38 (17+14:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:44 (17+15:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:38 (17+14:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:50:02.219+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291402.722","full_log":"type=USER_ACCT msg=audit(1670291401.892:22025): pid=3672 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22025","pid":"3672","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:50:02.219+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291402.722","full_log":"type=CRED_ACQ msg=audit(1670291401.892:22026): pid=3672 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22026","pid":"3672","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:50:02.219+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291402.722","full_log":"type=LOGIN msg=audit(1670291401.892:22027): pid=3672 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3045 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22027","pid":"3672","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:50:02.219+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291402.722","full_log":"type=CRED_REFR msg=audit(1670291401.905:22029): pid=3672 uid=0 auid=0 ses=3045 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22029","pid":"3672","uid":"0","auid":"0","session":"3045","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:50:02.219+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291402.722","full_log":"type=USER_END msg=audit(1670291401.920:22031): pid=3672 uid=0 auid=0 ses=3045 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22031","pid":"3672","auid":"0","uid":"0","session":"3045","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:50:02.219+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291402.722","full_log":"type=USER_START msg=audit(1670291401.904:22028): pid=3672 uid=0 auid=0 ses=3045 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22028","pid":"3672","uid":"0","auid":"0","session":"3045","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:50:02.219+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291402.722","full_log":"type=CRED_DISP msg=audit(1670291401.919:22030): pid=3672 uid=0 auid=0 ses=3045 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22030","pid":"3672","auid":"0","uid":"0","session":"3045","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T01:50:24.251+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291424.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:50:24.251+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291424.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:50:24.251+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291424.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:50:24.251+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291424.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:50:24.251+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291424.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:50:24.251+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291424.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777256  44630044      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:50:24.265+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291424.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:44 (17+15:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:50 (17+15:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:44 (17+15:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T01:56:24.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291784.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:56:24.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291784.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:56:24.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291784.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:56:24.564+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291784.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:56:24.564+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291784.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:56:24.564+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291784.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779332  44627968      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T01:56:24.574+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670291784.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:50 (17+15:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:56 (17+15:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:50 (17+15:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:00:02.805+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292002.722","full_log":"type=USER_ACCT msg=audit(1670292001.937:22032): pid=3717 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22032","pid":"3717","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:00:02.805+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292002.722","full_log":"type=CRED_ACQ msg=audit(1670292001.937:22033): pid=3717 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22033","pid":"3717","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:00:02.805+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292002.722","full_log":"type=USER_START msg=audit(1670292001.955:22035): pid=3717 uid=0 auid=0 ses=3046 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22035","pid":"3717","uid":"0","auid":"0","session":"3046","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:00:02.805+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292002.722","full_log":"type=LOGIN msg=audit(1670292001.937:22034): pid=3717 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3046 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22034","pid":"3717","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:00:02.805+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292002.722","full_log":"type=CRED_DISP msg=audit(1670292001.970:22037): pid=3717 uid=0 auid=0 ses=3046 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22037","pid":"3717","auid":"0","uid":"0","session":"3046","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:00:02.805+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292002.722","full_log":"type=CRED_REFR msg=audit(1670292001.956:22036): pid=3717 uid=0 auid=0 ses=3046 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22036","pid":"3717","uid":"0","auid":"0","session":"3046","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:00:02.805+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292002.722","full_log":"type=USER_END msg=audit(1670292001.972:22038): pid=3717 uid=0 auid=0 ses=3046 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22038","pid":"3717","auid":"0","uid":"0","session":"3046","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:01:02.861+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292062.722","full_log":"type=USER_ACCT msg=audit(1670292062.001:22039): pid=3727 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22039","pid":"3727","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:01:02.861+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292062.722","full_log":"type=CRED_ACQ msg=audit(1670292062.002:22040): pid=3727 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22040","pid":"3727","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:01:02.862+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292062.722","full_log":"type=USER_START msg=audit(1670292062.020:22042): pid=3727 uid=0 auid=0 ses=3047 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22042","pid":"3727","uid":"0","auid":"0","session":"3047","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:01:02.862+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292062.722","full_log":"type=CRED_REFR msg=audit(1670292062.021:22043): pid=3727 uid=0 auid=0 ses=3047 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22043","pid":"3727","uid":"0","auid":"0","session":"3047","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:01:02.862+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292062.722","full_log":"type=CRED_DISP msg=audit(1670292062.045:22044): pid=3727 uid=0 auid=0 ses=3047 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22044","pid":"3727","auid":"0","uid":"0","session":"3047","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:01:02.862+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292062.722","full_log":"type=USER_END msg=audit(1670292062.046:22045): pid=3727 uid=0 auid=0 ses=3047 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22045","pid":"3727","auid":"0","uid":"0","session":"3047","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:01:02.862+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292062.722","full_log":"type=LOGIN msg=audit(1670292062.003:22041): pid=3727 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3047 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22041","pid":"3727","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:02:24.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292144.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:02:24.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292144.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:02:24.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292144.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:02:24.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292144.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:02:24.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292144.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:02:24.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292144.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779516  44627784      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:02:24.964+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292144.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:56 (17+15:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:02 (17+15:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 01:56 (17+15:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:08:25.340+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292505.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:08:25.341+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292505.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:08:25.341+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292505.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:08:25.341+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292505.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779368  44627932      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:08:25.341+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292505.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:08:25.340+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292505.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:08:25.347+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292505.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:02 (17+15:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:08 (17+15:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:02 (17+15:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:10:01.438+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292601.722","full_log":"type=USER_ACCT msg=audit(1670292601.072:22046): pid=3781 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22046","pid":"3781","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:10:01.438+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292601.722","full_log":"type=LOGIN msg=audit(1670292601.073:22048): pid=3781 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3048 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22048","pid":"3781","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:10:01.438+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292601.722","full_log":"type=CRED_REFR msg=audit(1670292601.096:22050): pid=3781 uid=0 auid=0 ses=3048 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22050","pid":"3781","uid":"0","auid":"0","session":"3048","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:10:01.438+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292601.722","full_log":"type=CRED_ACQ msg=audit(1670292601.073:22047): pid=3781 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22047","pid":"3781","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:10:01.438+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292601.722","full_log":"type=CRED_DISP msg=audit(1670292601.117:22051): pid=3781 uid=0 auid=0 ses=3048 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22051","pid":"3781","auid":"0","uid":"0","session":"3048","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:10:01.438+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292601.722","full_log":"type=USER_END msg=audit(1670292601.119:22052): pid=3781 uid=0 auid=0 ses=3048 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22052","pid":"3781","auid":"0","uid":"0","session":"3048","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:10:01.438+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292601.722","full_log":"type=USER_START msg=audit(1670292601.095:22049): pid=3781 uid=0 auid=0 ses=3048 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22049","pid":"3781","uid":"0","auid":"0","session":"3048","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:14:25.690+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292865.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:14:25.690+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292865.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:14:25.690+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292865.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:14:25.690+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292865.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:14:25.690+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292865.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:14:25.690+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292865.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777892  44629408      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:14:25.704+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670292865.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:08 (17+15:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:14 (17+15:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:08 (17+15:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:20:01.863+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293201.722","full_log":"type=USER_ACCT msg=audit(1670293201.146:22053): pid=3834 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22053","pid":"3834","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:20:01.863+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293201.722","full_log":"type=LOGIN msg=audit(1670293201.147:22055): pid=3834 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3049 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22055","pid":"3834","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:20:01.863+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293201.722","full_log":"type=CRED_ACQ msg=audit(1670293201.147:22054): pid=3834 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22054","pid":"3834","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:20:01.864+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293201.722","full_log":"type=USER_START msg=audit(1670293201.167:22056): pid=3834 uid=0 auid=0 ses=3049 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22056","pid":"3834","uid":"0","auid":"0","session":"3049","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:20:01.864+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293201.722","full_log":"type=CRED_REFR msg=audit(1670293201.168:22057): pid=3834 uid=0 auid=0 ses=3049 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22057","pid":"3834","uid":"0","auid":"0","session":"3049","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:20:01.864+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293201.722","full_log":"type=USER_END msg=audit(1670293201.188:22059): pid=3834 uid=0 auid=0 ses=3049 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22059","pid":"3834","auid":"0","uid":"0","session":"3049","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:20:01.864+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293201.722","full_log":"type=CRED_DISP msg=audit(1670293201.185:22058): pid=3834 uid=0 auid=0 ses=3049 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22058","pid":"3834","auid":"0","uid":"0","session":"3049","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:20:25.900+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293225.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:20:25.900+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293225.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:20:25.900+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293225.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:20:25.900+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293225.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:20:25.900+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293225.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777684  44629616      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:20:25.900+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293225.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:20:25.914+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293225.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:14 (17+15:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:20 (17+15:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:14 (17+15:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:26:26.307+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293586.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:26:26.307+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293586.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:26:26.308+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293586.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7777964  44629336      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:26:26.308+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293586.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:26:26.308+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293586.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:26:26.307+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293586.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:26:26.327+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293586.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:20 (17+15:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:26 (17+15:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:20 (17+15:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:30:02.558+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293802.722","full_log":"type=LOGIN msg=audit(1670293801.212:22062): pid=3878 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3050 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22062","pid":"3878","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:30:02.558+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293802.722","full_log":"type=CRED_REFR msg=audit(1670293801.241:22064): pid=3878 uid=0 auid=0 ses=3050 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22064","pid":"3878","uid":"0","auid":"0","session":"3050","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:30:02.558+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293802.722","full_log":"type=USER_ACCT msg=audit(1670293801.211:22060): pid=3878 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22060","pid":"3878","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:30:02.558+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293802.722","full_log":"type=CRED_DISP msg=audit(1670293801.257:22065): pid=3878 uid=0 auid=0 ses=3050 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22065","pid":"3878","auid":"0","uid":"0","session":"3050","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:30:02.558+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293802.722","full_log":"type=CRED_ACQ msg=audit(1670293801.211:22061): pid=3878 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22061","pid":"3878","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:30:02.558+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293802.722","full_log":"type=USER_START msg=audit(1670293801.240:22063): pid=3878 uid=0 auid=0 ses=3050 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22063","pid":"3878","uid":"0","auid":"0","session":"3050","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:30:02.559+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293802.722","full_log":"type=USER_END msg=audit(1670293801.258:22066): pid=3878 uid=0 auid=0 ses=3050 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22066","pid":"3878","auid":"0","uid":"0","session":"3050","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:32:26.718+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293946.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:32:26.718+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293946.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:32:26.718+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293946.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:32:26.718+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293946.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778248  44629052      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:32:26.718+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293946.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:32:26.718+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293946.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:32:26.733+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670293946.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:26 (17+15:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:32 (17+15:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:26 (17+15:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:38:27.113+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294307.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:38:27.113+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294307.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:38:27.113+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294307.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:38:27.113+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294307.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:38:27.113+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294307.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:38:27.113+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294307.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778164  44629136      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:38:27.124+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294307.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:32 (17+15:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:38 (17+15:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:32 (17+15:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:40:03.220+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294403.722","full_log":"type=USER_ACCT msg=audit(1670294401.280:22067): pid=3923 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22067","pid":"3923","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:40:03.221+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294403.722","full_log":"type=CRED_REFR msg=audit(1670294401.298:22071): pid=3923 uid=0 auid=0 ses=3051 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22071","pid":"3923","uid":"0","auid":"0","session":"3051","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:40:03.221+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294403.722","full_log":"type=LOGIN msg=audit(1670294401.280:22069): pid=3923 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3051 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22069","pid":"3923","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:40:03.221+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294403.722","full_log":"type=USER_END msg=audit(1670294401.310:22073): pid=3923 uid=0 auid=0 ses=3051 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22073","pid":"3923","auid":"0","uid":"0","session":"3051","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:40:03.221+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294403.722","full_log":"type=CRED_ACQ msg=audit(1670294401.280:22068): pid=3923 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22068","pid":"3923","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:40:03.221+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294403.722","full_log":"type=CRED_DISP msg=audit(1670294401.309:22072): pid=3923 uid=0 auid=0 ses=3051 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22072","pid":"3923","auid":"0","uid":"0","session":"3051","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:40:03.221+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294403.722","full_log":"type=USER_START msg=audit(1670294401.297:22070): pid=3923 uid=0 auid=0 ses=3051 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22070","pid":"3923","uid":"0","auid":"0","session":"3051","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:44:27.430+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294667.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:44:27.430+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294667.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:44:27.430+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294667.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:44:27.430+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294667.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:44:27.430+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294667.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:44:27.430+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294667.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778188  44629112      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:44:27.447+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670294667.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:38 (17+15:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:44 (17+16:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:38 (17+15:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:50:01.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295001.722","full_log":"type=USER_ACCT msg=audit(1670295001.327:22074): pid=4712 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22074","pid":"4712","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:50:01.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295001.722","full_log":"type=USER_START msg=audit(1670295001.350:22077): pid=4712 uid=0 auid=0 ses=3052 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22077","pid":"4712","uid":"0","auid":"0","session":"3052","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:50:01.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295001.722","full_log":"type=CRED_REFR msg=audit(1670295001.352:22078): pid=4712 uid=0 auid=0 ses=3052 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22078","pid":"4712","uid":"0","auid":"0","session":"3052","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:50:01.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295001.722","full_log":"type=USER_END msg=audit(1670295001.373:22080): pid=4712 uid=0 auid=0 ses=3052 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22080","pid":"4712","auid":"0","uid":"0","session":"3052","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:50:01.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295001.722","full_log":"type=LOGIN msg=audit(1670295001.327:22076): pid=4712 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3052 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22076","pid":"4712","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:50:01.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295001.722","full_log":"type=CRED_ACQ msg=audit(1670295001.327:22075): pid=4712 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22075","pid":"4712","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:50:01.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295001.722","full_log":"type=CRED_DISP msg=audit(1670295001.371:22079): pid=4712 uid=0 auid=0 ses=3052 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22079","pid":"4712","auid":"0","uid":"0","session":"3052","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T02:50:27.812+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295027.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:50:27.812+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295027.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:50:27.812+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295027.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:50:27.812+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295027.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778644  44628656      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:50:27.812+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295027.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:50:27.812+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295027.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:50:27.821+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295027.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:44 (17+16:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:50 (17+16:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:44 (17+16:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T02:56:28.164+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295388.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:56:28.164+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295388.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:56:28.164+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295388.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:56:28.164+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295388.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:56:28.164+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295388.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:56:28.164+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295388.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778468  44628832      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T02:56:28.176+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295388.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:50 (17+16:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:56 (17+16:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:50 (17+16:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:00:02.392+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295602.722","full_log":"type=USER_ACCT msg=audit(1670295601.403:22081): pid=5279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22081","pid":"5279","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:00:02.392+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295602.722","full_log":"type=USER_START msg=audit(1670295601.423:22084): pid=5279 uid=0 auid=0 ses=3053 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22084","pid":"5279","uid":"0","auid":"0","session":"3053","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:00:02.392+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295602.722","full_log":"type=CRED_ACQ msg=audit(1670295601.403:22082): pid=5279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22082","pid":"5279","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:00:02.392+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295602.722","full_log":"type=CRED_REFR msg=audit(1670295601.424:22085): pid=5279 uid=0 auid=0 ses=3053 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22085","pid":"5279","uid":"0","auid":"0","session":"3053","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:00:02.392+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295602.722","full_log":"type=CRED_DISP msg=audit(1670295601.439:22086): pid=5279 uid=0 auid=0 ses=3053 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22086","pid":"5279","auid":"0","uid":"0","session":"3053","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:00:02.392+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295602.722","full_log":"type=LOGIN msg=audit(1670295601.403:22083): pid=5279 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3053 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22083","pid":"5279","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:00:02.392+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295602.722","full_log":"type=USER_END msg=audit(1670295601.440:22087): pid=5279 uid=0 auid=0 ses=3053 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22087","pid":"5279","auid":"0","uid":"0","session":"3053","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:01:02.458+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295662.722","full_log":"type=USER_ACCT msg=audit(1670295661.454:22088): pid=5288 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22088","pid":"5288","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:01:02.458+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295662.722","full_log":"type=LOGIN msg=audit(1670295661.455:22090): pid=5288 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3054 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22090","pid":"5288","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:01:02.458+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295662.722","full_log":"type=USER_START msg=audit(1670295661.470:22091): pid=5288 uid=0 auid=0 ses=3054 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22091","pid":"5288","uid":"0","auid":"0","session":"3054","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:01:02.458+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295662.722","full_log":"type=CRED_REFR msg=audit(1670295661.470:22092): pid=5288 uid=0 auid=0 ses=3054 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22092","pid":"5288","uid":"0","auid":"0","session":"3054","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:01:02.458+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295662.722","full_log":"type=USER_END msg=audit(1670295661.511:22094): pid=5288 uid=0 auid=0 ses=3054 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22094","pid":"5288","auid":"0","uid":"0","session":"3054","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:01:02.458+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295662.722","full_log":"type=CRED_DISP msg=audit(1670295661.510:22093): pid=5288 uid=0 auid=0 ses=3054 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22093","pid":"5288","auid":"0","uid":"0","session":"3054","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:01:02.458+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295662.722","full_log":"type=CRED_ACQ msg=audit(1670295661.455:22089): pid=5288 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22089","pid":"5288","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:02:28.519+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:02:28.519+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:02:28.519+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:02:28.519+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33540   4053392       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:02:28.519+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780572  44626728      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:02:28.519+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:02:28.519+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","full_log":"ossec: output: 'df -P': tmpfs               817388       0    817388       0% /run/user/0","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:02:28.524+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295748.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:56 (17+16:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:02 (17+16:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 02:56 (17+16:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:05:02.653+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295902.722","full_log":"type=USER_START msg=audit(1670295901.539:22098): pid=5318 uid=0 auid=0 ses=3055 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22098","pid":"5318","uid":"0","auid":"0","session":"3055","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:05:02.653+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295902.722","full_log":"type=CRED_REFR msg=audit(1670295901.540:22099): pid=5318 uid=0 auid=0 ses=3055 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22099","pid":"5318","uid":"0","auid":"0","session":"3055","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:05:02.653+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295902.722","full_log":"type=LOGIN msg=audit(1670295901.530:22097): pid=5318 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3055 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22097","pid":"5318","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:05:02.653+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295902.722","full_log":"type=USER_END msg=audit(1670295901.566:22101): pid=5318 uid=0 auid=0 ses=3055 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22101","pid":"5318","auid":"0","uid":"0","session":"3055","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:05:02.653+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295902.722","full_log":"type=CRED_ACQ msg=audit(1670295901.530:22096): pid=5318 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22096","pid":"5318","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:05:02.653+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295902.722","full_log":"type=USER_ACCT msg=audit(1670295901.530:22095): pid=5318 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22095","pid":"5318","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:05:02.653+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670295902.722","full_log":"type=CRED_DISP msg=audit(1670295901.565:22100): pid=5318 uid=0 auid=0 ses=3055 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22100","pid":"5318","auid":"0","uid":"0","session":"3055","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:08:28.852+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:08:28.852+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:08:28.852+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33540   4053392       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:08:28.852+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:08:28.852+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778732  44628568      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:08:28.852+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:08:28.852+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","full_log":"ossec: output: 'df -P': tmpfs               817388       0    817388       0% /run/user/0","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:08:28.866+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296108.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:02 (17+16:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:08 (17+16:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:02 (17+16:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:10:02.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296202.722","full_log":"type=CRED_ACQ msg=audit(1670296201.580:22103): pid=5342 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22103","pid":"5342","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:10:02.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296202.722","full_log":"type=USER_START msg=audit(1670296201.591:22105): pid=5342 uid=0 auid=0 ses=3056 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22105","pid":"5342","uid":"0","auid":"0","session":"3056","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:10:02.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296202.722","full_log":"type=CRED_REFR msg=audit(1670296201.592:22106): pid=5342 uid=0 auid=0 ses=3056 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22106","pid":"5342","uid":"0","auid":"0","session":"3056","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:10:02.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296202.722","full_log":"type=USER_END msg=audit(1670296201.614:22108): pid=5342 uid=0 auid=0 ses=3056 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22108","pid":"5342","auid":"0","uid":"0","session":"3056","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:10:02.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296202.722","full_log":"type=CRED_DISP msg=audit(1670296201.612:22107): pid=5342 uid=0 auid=0 ses=3056 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22107","pid":"5342","auid":"0","uid":"0","session":"3056","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:10:02.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296202.722","full_log":"type=USER_ACCT msg=audit(1670296201.580:22102): pid=5342 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22102","pid":"5342","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:10:02.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296202.722","full_log":"type=LOGIN msg=audit(1670296201.580:22104): pid=5342 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3056 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22104","pid":"5342","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:14:29.158+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33540   4053392       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:14:29.158+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:14:29.158+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:14:29.158+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:14:29.158+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:14:29.158+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778780  44628520      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:14:29.158+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","full_log":"ossec: output: 'df -P': tmpfs               817388       0    817388       0% /run/user/0","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:14:29.167+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296469.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:08 (17+16:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:14 (17+16:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:08 (17+16:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:20:03.517+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296803.722","full_log":"type=CRED_ACQ msg=audit(1670296801.640:22110): pid=5392 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22110","pid":"5392","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:20:03.517+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296803.722","full_log":"type=USER_ACCT msg=audit(1670296801.639:22109): pid=5392 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22109","pid":"5392","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:20:03.517+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296803.722","full_log":"type=LOGIN msg=audit(1670296801.641:22111): pid=5392 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3057 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22111","pid":"5392","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:20:03.517+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296803.722","full_log":"type=USER_START msg=audit(1670296801.651:22112): pid=5392 uid=0 auid=0 ses=3057 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22112","pid":"5392","uid":"0","auid":"0","session":"3057","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:20:03.517+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296803.722","full_log":"type=CRED_REFR msg=audit(1670296801.651:22113): pid=5392 uid=0 auid=0 ses=3057 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22113","pid":"5392","uid":"0","auid":"0","session":"3057","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:20:03.517+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296803.722","full_log":"type=CRED_DISP msg=audit(1670296801.664:22114): pid=5392 uid=0 auid=0 ses=3057 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22114","pid":"5392","auid":"0","uid":"0","session":"3057","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:20:03.518+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296803.722","full_log":"type=USER_END msg=audit(1670296801.666:22115): pid=5392 uid=0 auid=0 ses=3057 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22115","pid":"5392","auid":"0","uid":"0","session":"3057","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:20:29.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:20:29.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:20:29.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:20:29.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33540   4053392       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:20:29.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:20:29.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778944  44628356      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:20:29.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","full_log":"ossec: output: 'df -P': tmpfs               817388       0    817388       0% /run/user/0","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:20:29.568+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670296829.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:14 (17+16:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:20 (17+16:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:14 (17+16:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:26:29.879+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297189.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:26:29.879+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297189.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:26:29.879+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297189.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:26:29.879+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297189.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:26:29.879+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297189.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778480  44628820      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:26:29.879+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297189.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:26:29.894+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297189.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:20 (17+16:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:26 (17+16:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:20 (17+16:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:30:02.115+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297402.722","full_log":"type=CRED_ACQ msg=audit(1670297401.687:22117): pid=5459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22117","pid":"5459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:30:02.115+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297402.722","full_log":"type=USER_START msg=audit(1670297401.714:22119): pid=5459 uid=0 auid=0 ses=3058 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22119","pid":"5459","uid":"0","auid":"0","session":"3058","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:30:02.115+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297402.722","full_log":"type=CRED_REFR msg=audit(1670297401.715:22120): pid=5459 uid=0 auid=0 ses=3058 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22120","pid":"5459","uid":"0","auid":"0","session":"3058","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:30:02.115+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297402.722","full_log":"type=CRED_DISP msg=audit(1670297401.743:22121): pid=5459 uid=0 auid=0 ses=3058 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22121","pid":"5459","auid":"0","uid":"0","session":"3058","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:30:02.115+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297402.722","full_log":"type=USER_ACCT msg=audit(1670297401.687:22116): pid=5459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22116","pid":"5459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:30:02.115+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297402.722","full_log":"type=USER_END msg=audit(1670297401.746:22122): pid=5459 uid=0 auid=0 ses=3058 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22122","pid":"5459","auid":"0","uid":"0","session":"3058","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:30:02.115+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297402.722","full_log":"type=LOGIN msg=audit(1670297401.689:22118): pid=5459 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3058 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22118","pid":"5459","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:32:30.281+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297550.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:32:30.281+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297550.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:32:30.281+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297550.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:32:30.281+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297550.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:32:30.281+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297550.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:32:30.281+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297550.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780772  44626528      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:32:30.293+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297550.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:26 (17+16:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:32 (17+16:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:26 (17+16:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:38:30.626+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297910.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:38:30.626+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297910.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:38:30.626+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297910.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:38:30.626+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297910.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:38:30.626+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297910.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:38:30.626+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297910.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780460  44626840      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:38:30.642+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670297910.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:32 (17+16:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:38 (17+16:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:32 (17+16:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:40:02.742+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298002.722","full_log":"type=USER_ACCT msg=audit(1670298001.764:22123): pid=5503 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22123","pid":"5503","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:40:02.742+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298002.722","full_log":"type=CRED_ACQ msg=audit(1670298001.764:22124): pid=5503 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22124","pid":"5503","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:40:02.742+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298002.722","full_log":"type=USER_START msg=audit(1670298001.782:22126): pid=5503 uid=0 auid=0 ses=3059 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22126","pid":"5503","uid":"0","auid":"0","session":"3059","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:40:02.742+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298002.722","full_log":"type=CRED_DISP msg=audit(1670298001.798:22128): pid=5503 uid=0 auid=0 ses=3059 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22128","pid":"5503","auid":"0","uid":"0","session":"3059","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:40:02.742+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298002.722","full_log":"type=CRED_REFR msg=audit(1670298001.783:22127): pid=5503 uid=0 auid=0 ses=3059 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22127","pid":"5503","uid":"0","auid":"0","session":"3059","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:40:02.742+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298002.722","full_log":"type=USER_END msg=audit(1670298001.799:22129): pid=5503 uid=0 auid=0 ses=3059 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22129","pid":"5503","auid":"0","uid":"0","session":"3059","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:40:02.742+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298002.722","full_log":"type=LOGIN msg=audit(1670298001.764:22125): pid=5503 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3059 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22125","pid":"5503","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:44:31.033+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298271.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:44:31.034+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298271.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:44:31.034+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298271.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:44:31.034+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298271.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:44:31.034+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298271.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:44:31.034+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298271.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778556  44628744      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:44:31.043+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298271.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:38 (17+16:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:44 (17+17:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:38 (17+16:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:50:03.373+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298603.722","full_log":"type=CRED_ACQ msg=audit(1670298601.820:22131): pid=5539 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22131","pid":"5539","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:50:03.373+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298603.722","full_log":"type=USER_START msg=audit(1670298601.835:22133): pid=5539 uid=0 auid=0 ses=3060 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22133","pid":"5539","uid":"0","auid":"0","session":"3060","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:50:03.373+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298603.722","full_log":"type=USER_ACCT msg=audit(1670298601.819:22130): pid=5539 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22130","pid":"5539","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:50:03.373+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298603.722","full_log":"type=CRED_DISP msg=audit(1670298601.848:22135): pid=5539 uid=0 auid=0 ses=3060 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22135","pid":"5539","auid":"0","uid":"0","session":"3060","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:50:03.373+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298603.722","full_log":"type=CRED_REFR msg=audit(1670298601.835:22134): pid=5539 uid=0 auid=0 ses=3060 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22134","pid":"5539","uid":"0","auid":"0","session":"3060","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:50:03.373+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298603.722","full_log":"type=LOGIN msg=audit(1670298601.820:22132): pid=5539 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3060 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22132","pid":"5539","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:50:03.373+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298603.722","full_log":"type=USER_END msg=audit(1670298601.849:22136): pid=5539 uid=0 auid=0 ses=3060 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22136","pid":"5539","auid":"0","uid":"0","session":"3060","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T03:50:31.405+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298631.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:50:31.405+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298631.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:50:31.405+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298631.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:50:31.405+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298631.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:50:31.405+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298631.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778992  44628308      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:50:31.405+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298631.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:50:31.414+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298631.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:44 (17+17:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:50 (17+17:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:44 (17+17:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T03:56:31.723+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298991.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:56:31.723+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298991.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:56:31.723+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298991.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:56:31.723+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298991.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:56:31.723+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298991.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778728  44628572      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:56:31.723+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298991.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T03:56:31.733+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670298991.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:50 (17+17:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:56 (17+17:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:50 (17+17:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:00:01.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299201.722","full_log":"type=USER_START msg=audit(1670299201.909:22140): pid=5584 uid=0 auid=0 ses=3061 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22140","pid":"5584","uid":"0","auid":"0","session":"3061","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:00:01.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299201.722","full_log":"type=CRED_REFR msg=audit(1670299201.909:22141): pid=5584 uid=0 auid=0 ses=3061 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22141","pid":"5584","uid":"0","auid":"0","session":"3061","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:00:01.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299201.722","full_log":"type=LOGIN msg=audit(1670299201.884:22139): pid=5584 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3061 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22139","pid":"5584","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:00:01.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299201.722","full_log":"type=CRED_DISP msg=audit(1670299201.926:22142): pid=5584 uid=0 auid=0 ses=3061 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22142","pid":"5584","auid":"0","uid":"0","session":"3061","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:00:01.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299201.722","full_log":"type=USER_END msg=audit(1670299201.929:22143): pid=5584 uid=0 auid=0 ses=3061 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22143","pid":"5584","auid":"0","uid":"0","session":"3061","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:00:01.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299201.722","full_log":"type=CRED_ACQ msg=audit(1670299201.884:22138): pid=5584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22138","pid":"5584","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:00:01.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299201.722","full_log":"type=USER_ACCT msg=audit(1670299201.883:22137): pid=5584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22137","pid":"5584","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:01:02.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299262.722","full_log":"type=USER_ACCT msg=audit(1670299261.943:22144): pid=5592 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22144","pid":"5592","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:01:02.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299262.722","full_log":"type=LOGIN msg=audit(1670299261.943:22146): pid=5592 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3062 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22146","pid":"5592","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:01:02.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299262.722","full_log":"type=USER_START msg=audit(1670299261.959:22147): pid=5592 uid=0 auid=0 ses=3062 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22147","pid":"5592","uid":"0","auid":"0","session":"3062","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:01:02.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299262.722","full_log":"type=CRED_REFR msg=audit(1670299261.959:22148): pid=5592 uid=0 auid=0 ses=3062 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22148","pid":"5592","uid":"0","auid":"0","session":"3062","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:01:02.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299262.722","full_log":"type=CRED_ACQ msg=audit(1670299261.943:22145): pid=5592 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22145","pid":"5592","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:01:02.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299262.722","full_log":"type=CRED_DISP msg=audit(1670299261.980:22149): pid=5592 uid=0 auid=0 ses=3062 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22149","pid":"5592","auid":"0","uid":"0","session":"3062","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:01:02.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299262.722","full_log":"type=USER_END msg=audit(1670299261.982:22150): pid=5592 uid=0 auid=0 ses=3062 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22150","pid":"5592","auid":"0","uid":"0","session":"3062","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:02:32.101+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299352.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:02:32.101+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299352.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:02:32.101+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299352.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:02:32.101+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299352.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:02:32.101+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299352.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:02:32.101+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299352.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780200  44627100      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:02:32.115+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299352.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:56 (17+17:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:02 (17+17:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 03:56 (17+17:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:08:32.476+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299712.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:08:32.476+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299712.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:08:32.476+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299712.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:08:32.477+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299712.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:08:32.477+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299712.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780300  44627000      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:08:32.477+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299712.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:08:32.478+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299712.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:02 (17+17:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:08 (17+17:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:02 (17+17:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:10:02.535+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299802.722","full_log":"type=CRED_ACQ msg=audit(1670299802.007:22152): pid=5644 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22152","pid":"5644","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:10:02.535+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299802.722","full_log":"type=LOGIN msg=audit(1670299802.007:22153): pid=5644 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3063 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22153","pid":"5644","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:10:02.535+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299802.722","full_log":"type=CRED_REFR msg=audit(1670299802.032:22155): pid=5644 uid=0 auid=0 ses=3063 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22155","pid":"5644","uid":"0","auid":"0","session":"3063","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:10:02.535+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299802.722","full_log":"type=USER_START msg=audit(1670299802.030:22154): pid=5644 uid=0 auid=0 ses=3063 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22154","pid":"5644","uid":"0","auid":"0","session":"3063","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:10:02.535+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299802.722","full_log":"type=USER_END msg=audit(1670299802.056:22157): pid=5644 uid=0 auid=0 ses=3063 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22157","pid":"5644","auid":"0","uid":"0","session":"3063","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:10:02.535+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299802.722","full_log":"type=USER_ACCT msg=audit(1670299802.006:22151): pid=5644 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22151","pid":"5644","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:10:02.535+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670299802.722","full_log":"type=CRED_DISP msg=audit(1670299802.053:22156): pid=5644 uid=0 auid=0 ses=3063 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22156","pid":"5644","auid":"0","uid":"0","session":"3063","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:14:32.783+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300072.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:14:32.783+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300072.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:14:32.783+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300072.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:14:32.783+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300072.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:14:32.783+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300072.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778476  44628824      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:14:32.783+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300072.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:14:32.789+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300072.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:08 (17+17:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:14 (17+17:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:08 (17+17:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:20:01.106+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300401.722","full_log":"type=LOGIN msg=audit(1670300401.086:22160): pid=5697 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3064 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22160","pid":"5697","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:20:01.106+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300401.722","full_log":"type=CRED_ACQ msg=audit(1670300401.085:22159): pid=5697 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22159","pid":"5697","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:20:01.106+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300401.722","full_log":"type=USER_ACCT msg=audit(1670300401.085:22158): pid=5697 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22158","pid":"5697","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:20:01.139+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300401.722","full_log":"type=USER_START msg=audit(1670300401.110:22161): pid=5697 uid=0 auid=0 ses=3064 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22161","pid":"5697","uid":"0","auid":"0","session":"3064","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:20:01.139+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300401.722","full_log":"type=USER_END msg=audit(1670300401.132:22164): pid=5697 uid=0 auid=0 ses=3064 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22164","pid":"5697","auid":"0","uid":"0","session":"3064","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:20:01.139+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300401.722","full_log":"type=CRED_DISP msg=audit(1670300401.131:22163): pid=5697 uid=0 auid=0 ses=3064 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22163","pid":"5697","auid":"0","uid":"0","session":"3064","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:20:01.139+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300401.722","full_log":"type=CRED_REFR msg=audit(1670300401.110:22162): pid=5697 uid=0 auid=0 ses=3064 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22162","pid":"5697","uid":"0","auid":"0","session":"3064","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:20:33.154+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300433.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:20:33.154+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300433.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:20:33.155+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300433.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:20:33.155+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300433.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:20:33.155+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300433.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:20:33.155+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300433.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778640  44628660      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:20:33.164+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300433.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:14 (17+17:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:20 (17+17:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:14 (17+17:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:26:33.544+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300793.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:26:33.544+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300793.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:26:33.544+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300793.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:26:33.544+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300793.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:26:33.544+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300793.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:26:33.544+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300793.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778592  44628708      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:26:33.548+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670300793.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:20 (17+17:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:26 (17+17:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:20 (17+17:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:30:01.751+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301001.722","full_log":"type=USER_ACCT msg=audit(1670301001.155:22165): pid=5740 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22165","pid":"5740","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:30:01.751+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301001.722","full_log":"type=LOGIN msg=audit(1670301001.155:22167): pid=5740 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3065 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22167","pid":"5740","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:30:01.751+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301001.722","full_log":"type=CRED_ACQ msg=audit(1670301001.155:22166): pid=5740 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22166","pid":"5740","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:30:01.751+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301001.722","full_log":"type=CRED_REFR msg=audit(1670301001.178:22169): pid=5740 uid=0 auid=0 ses=3065 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22169","pid":"5740","uid":"0","auid":"0","session":"3065","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:30:01.751+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301001.722","full_log":"type=USER_END msg=audit(1670301001.200:22171): pid=5740 uid=0 auid=0 ses=3065 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22171","pid":"5740","auid":"0","uid":"0","session":"3065","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:30:01.751+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301001.722","full_log":"type=CRED_DISP msg=audit(1670301001.199:22170): pid=5740 uid=0 auid=0 ses=3065 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22170","pid":"5740","auid":"0","uid":"0","session":"3065","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:30:01.751+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301001.722","full_log":"type=USER_START msg=audit(1670301001.176:22168): pid=5740 uid=0 auid=0 ses=3065 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22168","pid":"5740","uid":"0","auid":"0","session":"3065","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:32:33.876+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301153.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:32:33.876+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301153.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:32:33.876+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301153.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:32:33.876+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301153.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:32:33.876+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301153.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778712  44628588      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:32:33.876+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301153.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:32:33.881+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301153.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:26 (17+17:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:32 (17+17:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:26 (17+17:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:38:34.255+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301514.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:38:34.255+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301514.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:38:34.255+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301514.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:38:34.255+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301514.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:38:34.255+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301514.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:38:34.255+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301514.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780744  44626556      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:38:34.263+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301514.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:32 (17+17:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:38 (17+17:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:32 (17+17:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:40:02.353+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301602.722","full_log":"type=USER_ACCT msg=audit(1670301601.217:22172): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22172","pid":"5784","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:40:02.353+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301602.722","full_log":"type=CRED_ACQ msg=audit(1670301601.217:22173): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22173","pid":"5784","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:40:02.353+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301602.722","full_log":"type=USER_START msg=audit(1670301601.234:22175): pid=5784 uid=0 auid=0 ses=3066 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22175","pid":"5784","uid":"0","auid":"0","session":"3066","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:40:02.353+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301602.722","full_log":"type=LOGIN msg=audit(1670301601.217:22174): pid=5784 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3066 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22174","pid":"5784","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:40:02.353+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301602.722","full_log":"type=CRED_DISP msg=audit(1670301601.248:22177): pid=5784 uid=0 auid=0 ses=3066 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22177","pid":"5784","auid":"0","uid":"0","session":"3066","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:40:02.353+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301602.722","full_log":"type=CRED_REFR msg=audit(1670301601.234:22176): pid=5784 uid=0 auid=0 ses=3066 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22176","pid":"5784","uid":"0","auid":"0","session":"3066","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:40:02.353+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301602.722","full_log":"type=USER_END msg=audit(1670301601.250:22178): pid=5784 uid=0 auid=0 ses=3066 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22178","pid":"5784","auid":"0","uid":"0","session":"3066","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:44:34.614+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301874.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:44:34.614+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301874.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:44:34.614+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301874.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:44:34.614+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301874.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:44:34.614+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301874.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:44:34.615+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301874.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778568  44628732      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:44:34.626+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670301874.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:38 (17+17:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:44 (17+18:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:38 (17+17:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:50:02.963+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302202.722","full_log":"type=USER_ACCT msg=audit(1670302201.265:22179): pid=6166 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22179","pid":"6166","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:50:02.963+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302202.722","full_log":"type=CRED_ACQ msg=audit(1670302201.265:22180): pid=6166 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22180","pid":"6166","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:50:02.963+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302202.722","full_log":"type=LOGIN msg=audit(1670302201.265:22181): pid=6166 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3067 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22181","pid":"6166","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:50:02.963+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302202.722","full_log":"type=USER_START msg=audit(1670302201.281:22182): pid=6166 uid=0 auid=0 ses=3067 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22182","pid":"6166","uid":"0","auid":"0","session":"3067","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:50:02.963+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302202.722","full_log":"type=CRED_REFR msg=audit(1670302201.282:22183): pid=6166 uid=0 auid=0 ses=3067 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22183","pid":"6166","uid":"0","auid":"0","session":"3067","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:50:02.963+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302202.722","full_log":"type=CRED_DISP msg=audit(1670302201.301:22184): pid=6166 uid=0 auid=0 ses=3067 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22184","pid":"6166","auid":"0","uid":"0","session":"3067","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:50:02.963+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302202.722","full_log":"type=USER_END msg=audit(1670302201.303:22185): pid=6166 uid=0 auid=0 ses=3067 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22185","pid":"6166","auid":"0","uid":"0","session":"3067","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T04:50:34.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302234.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:50:34.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302234.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:50:34.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302234.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:50:34.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302234.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:50:34.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302234.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778340  44628960      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:50:34.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302234.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:50:34.999+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302234.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:44 (17+18:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:50 (17+18:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:44 (17+18:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T04:56:35.333+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302595.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:56:35.333+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302595.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:56:35.333+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302595.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:56:35.333+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302595.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:56:35.333+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302595.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:56:35.333+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302595.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778344  44628956      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T04:56:35.347+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302595.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:50 (17+18:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:56 (17+18:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:50 (17+18:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:00:01.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302801.722","full_log":"type=CRED_ACQ msg=audit(1670302801.322:22187): pid=7142 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22187","pid":"7142","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:00:01.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302801.722","full_log":"type=LOGIN msg=audit(1670302801.323:22188): pid=7142 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3068 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22188","pid":"7142","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:00:01.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302801.722","full_log":"type=USER_START msg=audit(1670302801.343:22189): pid=7142 uid=0 auid=0 ses=3068 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22189","pid":"7142","uid":"0","auid":"0","session":"3068","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:00:01.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302801.722","full_log":"type=CRED_REFR msg=audit(1670302801.344:22190): pid=7142 uid=0 auid=0 ses=3068 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22190","pid":"7142","uid":"0","auid":"0","session":"3068","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:00:01.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302801.722","full_log":"type=USER_END msg=audit(1670302801.362:22192): pid=7142 uid=0 auid=0 ses=3068 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22192","pid":"7142","auid":"0","uid":"0","session":"3068","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:00:01.563+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302801.722","full_log":"type=CRED_DISP msg=audit(1670302801.360:22191): pid=7142 uid=0 auid=0 ses=3068 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22191","pid":"7142","auid":"0","uid":"0","session":"3068","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:00:01.562+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302801.722","full_log":"type=USER_ACCT msg=audit(1670302801.322:22186): pid=7142 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22186","pid":"7142","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:01:01.619+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302861.722","full_log":"type=USER_ACCT msg=audit(1670302861.384:22193): pid=7151 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22193","pid":"7151","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:01:01.619+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302861.722","full_log":"type=LOGIN msg=audit(1670302861.385:22195): pid=7151 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3069 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22195","pid":"7151","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:01:01.619+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302861.722","full_log":"type=USER_START msg=audit(1670302861.416:22196): pid=7151 uid=0 auid=0 ses=3069 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22196","pid":"7151","uid":"0","auid":"0","session":"3069","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:01:01.619+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302861.722","full_log":"type=CRED_ACQ msg=audit(1670302861.384:22194): pid=7151 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22194","pid":"7151","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:01:01.619+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302861.722","full_log":"type=CRED_REFR msg=audit(1670302861.417:22197): pid=7151 uid=0 auid=0 ses=3069 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22197","pid":"7151","uid":"0","auid":"0","session":"3069","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:01:01.619+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302861.722","full_log":"type=CRED_DISP msg=audit(1670302861.438:22198): pid=7151 uid=0 auid=0 ses=3069 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22198","pid":"7151","auid":"0","uid":"0","session":"3069","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:01:01.619+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302861.722","full_log":"type=USER_END msg=audit(1670302861.439:22199): pid=7151 uid=0 auid=0 ses=3069 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22199","pid":"7151","auid":"0","uid":"0","session":"3069","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:02:35.728+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302955.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:02:35.728+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302955.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:02:35.728+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302955.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:02:35.728+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302955.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:02:35.728+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302955.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:02:35.728+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302955.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778684  44628616      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:02:35.734+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670302955.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:56 (17+18:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:02 (17+18:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 04:56 (17+18:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:08:36.114+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303316.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:08:36.114+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303316.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:08:36.114+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303316.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:08:36.114+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303316.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:08:36.114+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303316.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780664  44626636      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:08:36.114+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303316.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:08:36.115+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303316.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:02 (17+18:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:08 (17+18:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:02 (17+18:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:10:02.183+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303402.722","full_log":"type=CRED_REFR msg=audit(1670303401.481:22204): pid=7202 uid=0 auid=0 ses=3070 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22204","pid":"7202","uid":"0","auid":"0","session":"3070","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:10:02.183+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303402.722","full_log":"type=USER_START msg=audit(1670303401.480:22203): pid=7202 uid=0 auid=0 ses=3070 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22203","pid":"7202","uid":"0","auid":"0","session":"3070","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:10:02.183+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303402.722","full_log":"type=USER_END msg=audit(1670303401.499:22206): pid=7202 uid=0 auid=0 ses=3070 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22206","pid":"7202","auid":"0","uid":"0","session":"3070","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:10:02.183+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303402.722","full_log":"type=CRED_ACQ msg=audit(1670303401.461:22201): pid=7202 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22201","pid":"7202","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:10:02.183+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303402.722","full_log":"type=CRED_DISP msg=audit(1670303401.498:22205): pid=7202 uid=0 auid=0 ses=3070 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22205","pid":"7202","auid":"0","uid":"0","session":"3070","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:10:02.183+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303402.722","full_log":"type=LOGIN msg=audit(1670303401.462:22202): pid=7202 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3070 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22202","pid":"7202","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:10:02.183+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303402.722","full_log":"type=USER_ACCT msg=audit(1670303401.461:22200): pid=7202 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22200","pid":"7202","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:14:36.378+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303676.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:14:36.378+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303676.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:14:36.378+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303676.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:14:36.378+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303676.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:14:36.378+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303676.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778868  44628432      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:14:36.378+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303676.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:14:36.393+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670303676.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:08 (17+18:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:14 (17+18:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:08 (17+18:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:20:02.725+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304002.722","full_log":"type=USER_ACCT msg=audit(1670304001.520:22207): pid=7256 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22207","pid":"7256","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:20:02.725+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304002.722","full_log":"type=LOGIN msg=audit(1670304001.521:22209): pid=7256 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3071 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22209","pid":"7256","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:20:02.725+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304002.722","full_log":"type=CRED_ACQ msg=audit(1670304001.520:22208): pid=7256 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22208","pid":"7256","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:20:02.725+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304002.722","full_log":"type=CRED_DISP msg=audit(1670304001.550:22212): pid=7256 uid=0 auid=0 ses=3071 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22212","pid":"7256","auid":"0","uid":"0","session":"3071","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:20:02.725+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304002.722","full_log":"type=CRED_REFR msg=audit(1670304001.537:22211): pid=7256 uid=0 auid=0 ses=3071 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22211","pid":"7256","uid":"0","auid":"0","session":"3071","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:20:02.725+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304002.722","full_log":"type=USER_START msg=audit(1670304001.536:22210): pid=7256 uid=0 auid=0 ses=3071 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22210","pid":"7256","uid":"0","auid":"0","session":"3071","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:20:02.725+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304002.722","full_log":"type=USER_END msg=audit(1670304001.552:22213): pid=7256 uid=0 auid=0 ses=3071 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22213","pid":"7256","auid":"0","uid":"0","session":"3071","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:20:36.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304036.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:20:36.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304036.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:20:36.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304036.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:20:36.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304036.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:20:36.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304036.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:20:36.774+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304036.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778660  44628640      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:20:36.789+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304036.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:14 (17+18:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:20 (17+18:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:14 (17+18:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:26:37.037+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304397.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:26:37.037+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304397.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:26:37.037+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304397.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:26:37.037+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304397.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:26:37.037+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304397.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:26:37.037+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304397.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778600  44628700      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:26:37.043+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304397.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:20 (17+18:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:26 (17+18:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:20 (17+18:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:30:03.249+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304603.722","full_log":"type=LOGIN msg=audit(1670304601.569:22216): pid=7300 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3072 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22216","pid":"7300","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:30:03.250+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304603.722","full_log":"type=CRED_DISP msg=audit(1670304601.601:22219): pid=7300 uid=0 auid=0 ses=3072 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22219","pid":"7300","auid":"0","uid":"0","session":"3072","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:30:03.250+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304603.722","full_log":"type=CRED_REFR msg=audit(1670304601.588:22218): pid=7300 uid=0 auid=0 ses=3072 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22218","pid":"7300","uid":"0","auid":"0","session":"3072","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:30:03.250+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304603.722","full_log":"type=USER_END msg=audit(1670304601.602:22220): pid=7300 uid=0 auid=0 ses=3072 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22220","pid":"7300","auid":"0","uid":"0","session":"3072","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:30:03.249+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304603.722","full_log":"type=USER_ACCT msg=audit(1670304601.568:22214): pid=7300 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22214","pid":"7300","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:30:03.249+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304603.722","full_log":"type=CRED_ACQ msg=audit(1670304601.569:22215): pid=7300 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22215","pid":"7300","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:30:03.249+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304603.722","full_log":"type=USER_START msg=audit(1670304601.587:22217): pid=7300 uid=0 auid=0 ses=3072 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22217","pid":"7300","uid":"0","auid":"0","session":"3072","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:32:37.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304757.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:32:37.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304757.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:32:37.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304757.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:32:37.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304757.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778852  44628448      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:32:37.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304757.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:32:37.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304757.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:32:37.423+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670304757.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:26 (17+18:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:32 (17+18:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:26 (17+18:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:38:37.781+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305117.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:38:37.781+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305117.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:38:37.781+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305117.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:38:37.781+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305117.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:38:37.781+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305117.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:38:37.781+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305117.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778740  44628560      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:38:37.792+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305117.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:32 (17+18:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:38 (17+18:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:32 (17+18:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:40:01.875+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305201.722","full_log":"type=CRED_ACQ msg=audit(1670305201.622:22222): pid=7345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22222","pid":"7345","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:40:01.875+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305201.722","full_log":"type=USER_START msg=audit(1670305201.638:22224): pid=7345 uid=0 auid=0 ses=3073 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22224","pid":"7345","uid":"0","auid":"0","session":"3073","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:40:01.875+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305201.722","full_log":"type=CRED_REFR msg=audit(1670305201.639:22225): pid=7345 uid=0 auid=0 ses=3073 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22225","pid":"7345","uid":"0","auid":"0","session":"3073","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:40:01.875+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305201.722","full_log":"type=USER_ACCT msg=audit(1670305201.621:22221): pid=7345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22221","pid":"7345","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:40:01.875+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305201.722","full_log":"type=LOGIN msg=audit(1670305201.622:22223): pid=7345 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3073 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22223","pid":"7345","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:40:01.875+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305201.722","full_log":"type=USER_END msg=audit(1670305201.663:22227): pid=7345 uid=0 auid=0 ses=3073 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22227","pid":"7345","auid":"0","uid":"0","session":"3073","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:40:01.875+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305201.722","full_log":"type=CRED_DISP msg=audit(1670305201.660:22226): pid=7345 uid=0 auid=0 ses=3073 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22226","pid":"7345","auid":"0","uid":"0","session":"3073","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:44:38.069+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305478.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:44:38.069+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305478.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:44:38.069+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305478.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:44:38.069+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305478.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781028  44626272      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:44:38.069+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305478.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:44:38.069+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305478.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:44:38.088+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305478.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:38 (17+18:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:44 (17+19:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:38 (17+18:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:50:02.431+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305802.722","full_log":"type=USER_ACCT msg=audit(1670305801.678:22228): pid=7383 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22228","pid":"7383","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:50:02.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305802.722","full_log":"type=CRED_ACQ msg=audit(1670305801.678:22229): pid=7383 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22229","pid":"7383","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:50:02.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305802.722","full_log":"type=CRED_REFR msg=audit(1670305801.697:22232): pid=7383 uid=0 auid=0 ses=3074 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22232","pid":"7383","uid":"0","auid":"0","session":"3074","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:50:02.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305802.722","full_log":"type=USER_START msg=audit(1670305801.696:22231): pid=7383 uid=0 auid=0 ses=3074 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22231","pid":"7383","uid":"0","auid":"0","session":"3074","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:50:02.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305802.722","full_log":"type=LOGIN msg=audit(1670305801.678:22230): pid=7383 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3074 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22230","pid":"7383","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:50:02.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305802.722","full_log":"type=USER_END msg=audit(1670305801.714:22234): pid=7383 uid=0 auid=0 ses=3074 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22234","pid":"7383","auid":"0","uid":"0","session":"3074","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:50:02.432+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305802.722","full_log":"type=CRED_DISP msg=audit(1670305801.712:22233): pid=7383 uid=0 auid=0 ses=3074 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22233","pid":"7383","auid":"0","uid":"0","session":"3074","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T05:50:38.473+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305838.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:50:38.473+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305838.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:50:38.473+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305838.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:50:38.473+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305838.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778684  44628616      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:50:38.473+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305838.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:50:38.473+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305838.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:50:38.483+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670305838.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:44 (17+19:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:50 (17+19:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:44 (17+19:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T05:56:38.835+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306198.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:56:38.836+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306198.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:56:38.836+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306198.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:56:38.836+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306198.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:56:38.836+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306198.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:56:38.836+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306198.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778732  44628568      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T05:56:38.857+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306198.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:50 (17+19:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:56 (17+19:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:50 (17+19:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:00:03.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306403.722","full_log":"type=USER_ACCT msg=audit(1670306401.733:22235): pid=7426 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22235","pid":"7426","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:00:03.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306403.722","full_log":"type=LOGIN msg=audit(1670306401.734:22237): pid=7426 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3075 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22237","pid":"7426","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:00:03.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306403.722","full_log":"type=USER_START msg=audit(1670306401.750:22238): pid=7426 uid=0 auid=0 ses=3075 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22238","pid":"7426","uid":"0","auid":"0","session":"3075","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:00:03.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306403.722","full_log":"type=CRED_REFR msg=audit(1670306401.751:22239): pid=7426 uid=0 auid=0 ses=3075 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22239","pid":"7426","uid":"0","auid":"0","session":"3075","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:00:03.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306403.722","full_log":"type=USER_END msg=audit(1670306401.763:22241): pid=7426 uid=0 auid=0 ses=3075 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22241","pid":"7426","auid":"0","uid":"0","session":"3075","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:00:03.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306403.722","full_log":"type=CRED_DISP msg=audit(1670306401.762:22240): pid=7426 uid=0 auid=0 ses=3075 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22240","pid":"7426","auid":"0","uid":"0","session":"3075","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:00:03.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306403.722","full_log":"type=CRED_ACQ msg=audit(1670306401.733:22236): pid=7426 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22236","pid":"7426","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:01:03.132+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306463.722","full_log":"type=USER_ACCT msg=audit(1670306461.777:22242): pid=7434 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22242","pid":"7434","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:01:03.132+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306463.722","full_log":"type=LOGIN msg=audit(1670306461.778:22244): pid=7434 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3076 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22244","pid":"7434","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:01:03.132+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306463.722","full_log":"type=CRED_REFR msg=audit(1670306461.792:22246): pid=7434 uid=0 auid=0 ses=3076 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22246","pid":"7434","uid":"0","auid":"0","session":"3076","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:01:03.132+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306463.722","full_log":"type=CRED_DISP msg=audit(1670306461.822:22247): pid=7434 uid=0 auid=0 ses=3076 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22247","pid":"7434","auid":"0","uid":"0","session":"3076","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:01:03.132+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306463.722","full_log":"type=USER_END msg=audit(1670306461.824:22248): pid=7434 uid=0 auid=0 ses=3076 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22248","pid":"7434","auid":"0","uid":"0","session":"3076","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:01:03.132+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306463.722","full_log":"type=CRED_ACQ msg=audit(1670306461.778:22243): pid=7434 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22243","pid":"7434","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:01:03.132+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306463.722","full_log":"type=USER_START msg=audit(1670306461.791:22245): pid=7434 uid=0 auid=0 ses=3076 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22245","pid":"7434","uid":"0","auid":"0","session":"3076","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:02:39.231+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306559.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:02:39.231+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306559.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:02:39.231+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306559.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:02:39.231+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306559.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:02:39.231+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306559.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:02:39.231+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306559.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779060  44628240      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:02:39.236+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306559.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:56 (17+19:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:02 (17+19:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 05:56 (17+19:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:08:39.613+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306919.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:08:39.613+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306919.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:08:39.613+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306919.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:08:39.613+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306919.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:08:39.613+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306919.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:08:39.613+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306919.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7778884  44628416      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:08:39.618+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670306919.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:02 (17+19:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:08 (17+19:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:02 (17+19:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:10:03.705+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307003.722","full_log":"type=LOGIN msg=audit(1670307001.840:22251): pid=7484 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3077 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22251","pid":"7484","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:10:03.705+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307003.722","full_log":"type=USER_ACCT msg=audit(1670307001.839:22249): pid=7484 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22249","pid":"7484","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:10:03.705+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307003.722","full_log":"type=USER_END msg=audit(1670307001.877:22255): pid=7484 uid=0 auid=0 ses=3077 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22255","pid":"7484","auid":"0","uid":"0","session":"3077","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:10:03.705+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307003.722","full_log":"type=USER_START msg=audit(1670307001.863:22252): pid=7484 uid=0 auid=0 ses=3077 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22252","pid":"7484","uid":"0","auid":"0","session":"3077","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:10:03.705+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307003.722","full_log":"type=CRED_DISP msg=audit(1670307001.876:22254): pid=7484 uid=0 auid=0 ses=3077 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22254","pid":"7484","auid":"0","uid":"0","session":"3077","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:10:03.705+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307003.722","full_log":"type=CRED_ACQ msg=audit(1670307001.840:22250): pid=7484 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22250","pid":"7484","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:10:03.705+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307003.722","full_log":"type=CRED_REFR msg=audit(1670307001.863:22253): pid=7484 uid=0 auid=0 ses=3077 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22253","pid":"7484","uid":"0","auid":"0","session":"3077","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:14:39.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307279.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:14:39.965+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307279.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:14:39.965+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307279.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:14:39.965+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307279.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:14:39.965+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307279.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:14:39.965+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307279.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781160  44626140      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:14:39.969+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307279.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:08 (17+19:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:14 (17+19:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:08 (17+19:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:20:02.241+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307602.722","full_log":"type=CRED_ACQ msg=audit(1670307601.892:22257): pid=7539 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22257","pid":"7539","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:20:02.241+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307602.722","full_log":"type=LOGIN msg=audit(1670307601.892:22258): pid=7539 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3078 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22258","pid":"7539","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:20:02.241+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307602.722","full_log":"type=CRED_REFR msg=audit(1670307601.907:22260): pid=7539 uid=0 auid=0 ses=3078 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22260","pid":"7539","uid":"0","auid":"0","session":"3078","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:20:02.241+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307602.722","full_log":"type=CRED_DISP msg=audit(1670307601.924:22261): pid=7539 uid=0 auid=0 ses=3078 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22261","pid":"7539","auid":"0","uid":"0","session":"3078","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:20:02.241+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307602.722","full_log":"type=USER_END msg=audit(1670307601.925:22262): pid=7539 uid=0 auid=0 ses=3078 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22262","pid":"7539","auid":"0","uid":"0","session":"3078","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:20:02.241+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307602.722","full_log":"type=USER_ACCT msg=audit(1670307601.892:22256): pid=7539 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22256","pid":"7539","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:20:02.241+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307602.722","full_log":"type=USER_START msg=audit(1670307601.907:22259): pid=7539 uid=0 auid=0 ses=3078 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22259","pid":"7539","uid":"0","auid":"0","session":"3078","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:20:40.291+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307640.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:20:40.291+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307640.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:20:40.291+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307640.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:20:40.291+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307640.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:20:40.291+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307640.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779156  44628144      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:20:40.291+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307640.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:20:40.301+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670307640.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:14 (17+19:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:20 (17+19:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:14 (17+19:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:26:40.644+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308000.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:26:40.644+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308000.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:26:40.644+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308000.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:26:40.644+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308000.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:26:40.644+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308000.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779028  44628272      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:26:40.644+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308000.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:26:40.658+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308000.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:20 (17+19:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:26 (17+19:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:20 (17+19:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:30:02.867+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308202.722","full_log":"type=LOGIN msg=audit(1670308201.940:22265): pid=7583 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3079 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22265","pid":"7583","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:30:02.867+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308202.722","full_log":"type=USER_START msg=audit(1670308201.957:22266): pid=7583 uid=0 auid=0 ses=3079 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22266","pid":"7583","uid":"0","auid":"0","session":"3079","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:30:02.867+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308202.722","full_log":"type=CRED_REFR msg=audit(1670308201.959:22267): pid=7583 uid=0 auid=0 ses=3079 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22267","pid":"7583","uid":"0","auid":"0","session":"3079","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:30:02.867+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308202.722","full_log":"type=CRED_DISP msg=audit(1670308201.973:22268): pid=7583 uid=0 auid=0 ses=3079 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22268","pid":"7583","auid":"0","uid":"0","session":"3079","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:30:02.867+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308202.722","full_log":"type=USER_END msg=audit(1670308201.974:22269): pid=7583 uid=0 auid=0 ses=3079 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22269","pid":"7583","auid":"0","uid":"0","session":"3079","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:30:02.866+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308202.722","full_log":"type=USER_ACCT msg=audit(1670308201.940:22263): pid=7583 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22263","pid":"7583","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:30:02.867+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308202.722","full_log":"type=CRED_ACQ msg=audit(1670308201.940:22264): pid=7583 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22264","pid":"7583","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:32:41.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308361.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:32:41.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308361.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:32:41.015+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308361.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:32:41.016+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308361.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:32:41.016+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308361.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:32:41.016+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308361.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779096  44628204      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:32:41.029+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308361.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:26 (17+19:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:32 (17+19:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:26 (17+19:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:38:41.326+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308721.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:38:41.327+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308721.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:38:41.327+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308721.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:38:41.327+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308721.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:38:41.327+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308721.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779136  44628164      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:38:41.327+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308721.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:38:41.337+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308721.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:32 (17+19:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:38 (17+19:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:32 (17+19:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:40:03.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308803.722","full_log":"type=CRED_ACQ msg=audit(1670308801.998:22271): pid=7628 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22271","pid":"7628","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:40:03.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308803.722","full_log":"type=USER_ACCT msg=audit(1670308801.998:22270): pid=7628 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22270","pid":"7628","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:40:03.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308803.722","full_log":"type=USER_START msg=audit(1670308802.018:22273): pid=7628 uid=0 auid=0 ses=3080 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22273","pid":"7628","uid":"0","auid":"0","session":"3080","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:40:03.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308803.722","full_log":"type=CRED_DISP msg=audit(1670308802.036:22275): pid=7628 uid=0 auid=0 ses=3080 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22275","pid":"7628","auid":"0","uid":"0","session":"3080","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:40:03.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308803.722","full_log":"type=USER_END msg=audit(1670308802.039:22276): pid=7628 uid=0 auid=0 ses=3080 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22276","pid":"7628","auid":"0","uid":"0","session":"3080","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:40:03.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308803.722","full_log":"type=CRED_REFR msg=audit(1670308802.019:22274): pid=7628 uid=0 auid=0 ses=3080 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22274","pid":"7628","uid":"0","auid":"0","session":"3080","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:40:03.422+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670308803.722","full_log":"type=LOGIN msg=audit(1670308801.999:22272): pid=7628 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3080 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22272","pid":"7628","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:44:41.678+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309081.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:44:41.678+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309081.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:44:41.678+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309081.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:44:41.678+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309081.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:44:41.678+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309081.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:44:41.678+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309081.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779280  44628020      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:44:41.682+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309081.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:38 (17+19:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:44 (17+20:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:38 (17+19:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:50:02.007+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309402.722","full_log":"type=CRED_ACQ msg=audit(1670309401.061:22278): pid=7664 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22278","pid":"7664","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:50:02.007+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309402.722","full_log":"type=USER_ACCT msg=audit(1670309401.061:22277): pid=7664 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22277","pid":"7664","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:50:02.008+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309402.722","full_log":"type=CRED_DISP msg=audit(1670309401.091:22282): pid=7664 uid=0 auid=0 ses=3081 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22282","pid":"7664","auid":"0","uid":"0","session":"3081","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:50:02.008+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309402.722","full_log":"type=USER_START msg=audit(1670309401.079:22280): pid=7664 uid=0 auid=0 ses=3081 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22280","pid":"7664","uid":"0","auid":"0","session":"3081","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:50:02.008+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309402.722","full_log":"type=USER_END msg=audit(1670309401.093:22283): pid=7664 uid=0 auid=0 ses=3081 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22283","pid":"7664","auid":"0","uid":"0","session":"3081","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:50:02.007+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309402.722","full_log":"type=LOGIN msg=audit(1670309401.061:22279): pid=7664 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3081 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22279","pid":"7664","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:50:02.008+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309402.722","full_log":"type=CRED_REFR msg=audit(1670309401.079:22281): pid=7664 uid=0 auid=0 ses=3081 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22281","pid":"7664","uid":"0","auid":"0","session":"3081","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T06:50:42.057+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309442.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:50:42.057+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309442.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:50:42.057+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309442.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:50:42.058+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309442.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:50:42.057+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309442.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:50:42.058+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309442.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779588  44627712      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:50:42.061+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309442.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:44 (17+20:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:50 (17+20:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:44 (17+20:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T06:56:42.407+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309802.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:56:42.407+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309802.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:56:42.407+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309802.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:56:42.407+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309802.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:56:42.407+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309802.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779492  44627808      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:56:42.407+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309802.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T06:56:42.411+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670309802.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:50 (17+20:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:56 (17+20:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:50 (17+20:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:00:02.623+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310002.722","full_log":"type=LOGIN msg=audit(1670310001.128:22286): pid=8984 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3082 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22286","pid":"8984","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:00:02.623+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310002.722","full_log":"type=CRED_REFR msg=audit(1670310001.152:22288): pid=8984 uid=0 auid=0 ses=3082 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22288","pid":"8984","uid":"0","auid":"0","session":"3082","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:00:02.623+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310002.722","full_log":"type=USER_START msg=audit(1670310001.151:22287): pid=8984 uid=0 auid=0 ses=3082 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22287","pid":"8984","uid":"0","auid":"0","session":"3082","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:00:02.623+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310002.722","full_log":"type=CRED_DISP msg=audit(1670310001.172:22289): pid=8984 uid=0 auid=0 ses=3082 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22289","pid":"8984","auid":"0","uid":"0","session":"3082","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:00:02.623+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310002.722","full_log":"type=USER_END msg=audit(1670310001.174:22290): pid=8984 uid=0 auid=0 ses=3082 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22290","pid":"8984","auid":"0","uid":"0","session":"3082","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:00:02.623+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310002.722","full_log":"type=CRED_ACQ msg=audit(1670310001.127:22285): pid=8984 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22285","pid":"8984","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:00:02.623+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310002.722","full_log":"type=USER_ACCT msg=audit(1670310001.127:22284): pid=8984 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22284","pid":"8984","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:01:02.687+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310062.722","full_log":"type=USER_ACCT msg=audit(1670310061.195:22291): pid=8993 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22291","pid":"8993","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:01:02.687+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310062.722","full_log":"type=CRED_ACQ msg=audit(1670310061.195:22292): pid=8993 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22292","pid":"8993","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:01:02.687+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310062.722","full_log":"type=CRED_REFR msg=audit(1670310061.224:22295): pid=8993 uid=0 auid=0 ses=3083 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22295","pid":"8993","uid":"0","auid":"0","session":"3083","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:01:02.687+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310062.722","full_log":"type=CRED_DISP msg=audit(1670310061.265:22296): pid=8993 uid=0 auid=0 ses=3083 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22296","pid":"8993","auid":"0","uid":"0","session":"3083","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:01:02.687+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310062.722","full_log":"type=USER_START msg=audit(1670310061.223:22294): pid=8993 uid=0 auid=0 ses=3083 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22294","pid":"8993","uid":"0","auid":"0","session":"3083","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:01:02.687+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310062.722","full_log":"type=LOGIN msg=audit(1670310061.196:22293): pid=8993 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3083 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22293","pid":"8993","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:01:02.687+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310062.722","full_log":"type=USER_END msg=audit(1670310061.268:22297): pid=8993 uid=0 auid=0 ses=3083 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22297","pid":"8993","auid":"0","uid":"0","session":"3083","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:02:42.807+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310162.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:02:42.807+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310162.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:02:42.807+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310162.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:02:42.807+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310162.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:02:42.807+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310162.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:02:42.807+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310162.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779580  44627720      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:02:42.809+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310162.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:56 (17+20:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:02 (17+20:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 06:56 (17+20:15)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:08:43.159+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310523.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:08:43.159+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310523.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:08:43.159+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310523.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:08:43.160+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310523.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:08:43.159+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310523.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:08:43.160+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310523.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779620  44627680      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:08:43.169+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310523.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:02 (17+20:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:08 (17+20:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:02 (17+20:21)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:10:03.254+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310603.722","full_log":"type=USER_ACCT msg=audit(1670310601.296:22298): pid=9043 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22298","pid":"9043","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:10:03.254+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310603.722","full_log":"type=LOGIN msg=audit(1670310601.296:22300): pid=9043 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3084 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22300","pid":"9043","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:10:03.254+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310603.722","full_log":"type=USER_START msg=audit(1670310601.309:22301): pid=9043 uid=0 auid=0 ses=3084 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22301","pid":"9043","uid":"0","auid":"0","session":"3084","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:10:03.254+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310603.722","full_log":"type=CRED_REFR msg=audit(1670310601.310:22302): pid=9043 uid=0 auid=0 ses=3084 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22302","pid":"9043","uid":"0","auid":"0","session":"3084","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:10:03.254+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310603.722","full_log":"type=USER_END msg=audit(1670310601.328:22304): pid=9043 uid=0 auid=0 ses=3084 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22304","pid":"9043","auid":"0","uid":"0","session":"3084","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:10:03.254+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310603.722","full_log":"type=CRED_DISP msg=audit(1670310601.326:22303): pid=9043 uid=0 auid=0 ses=3084 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22303","pid":"9043","auid":"0","uid":"0","session":"3084","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:10:03.254+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310603.722","full_log":"type=CRED_ACQ msg=audit(1670310601.296:22299): pid=9043 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22299","pid":"9043","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:14:43.542+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310883.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:14:43.542+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310883.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:14:43.542+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310883.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:14:43.543+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310883.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:14:43.543+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310883.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:14:43.543+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310883.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7779932  44627368      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:14:43.553+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670310883.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:08 (17+20:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:14 (17+20:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:08 (17+20:27)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:20:01.846+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311201.722","full_log":"type=USER_ACCT msg=audit(1670311201.356:22305): pid=9096 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22305","pid":"9096","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:20:01.846+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311201.722","full_log":"type=CRED_ACQ msg=audit(1670311201.356:22306): pid=9096 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22306","pid":"9096","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:20:01.846+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311201.722","full_log":"type=USER_START msg=audit(1670311201.376:22308): pid=9096 uid=0 auid=0 ses=3085 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22308","pid":"9096","uid":"0","auid":"0","session":"3085","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:20:01.846+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311201.722","full_log":"type=CRED_REFR msg=audit(1670311201.376:22309): pid=9096 uid=0 auid=0 ses=3085 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22309","pid":"9096","uid":"0","auid":"0","session":"3085","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:20:01.846+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311201.722","full_log":"type=LOGIN msg=audit(1670311201.357:22307): pid=9096 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3085 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22307","pid":"9096","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:20:01.846+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311201.722","full_log":"type=USER_END msg=audit(1670311201.398:22311): pid=9096 uid=0 auid=0 ses=3085 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22311","pid":"9096","auid":"0","uid":"0","session":"3085","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:20:01.846+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311201.722","full_log":"type=CRED_DISP msg=audit(1670311201.396:22310): pid=9096 uid=0 auid=0 ses=3085 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22310","pid":"9096","auid":"0","uid":"0","session":"3085","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:20:43.884+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311243.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:20:43.885+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311243.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:20:43.885+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311243.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:20:43.884+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311243.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:20:43.885+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311243.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:20:43.885+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311243.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781652  44625648      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:20:43.890+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311243.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:14 (17+20:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:20 (17+20:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:14 (17+20:33)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:26:44.194+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311604.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:26:44.195+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311604.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:26:44.195+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311604.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:26:44.195+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311604.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:26:44.195+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311604.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:26:44.195+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311604.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781652  44625648      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:26:44.207+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311604.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:20 (17+20:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:26 (17+20:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:20 (17+20:39)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:30:02.419+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311802.722","full_log":"type=USER_ACCT msg=audit(1670311801.424:22312): pid=9143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22312","pid":"9143","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:30:02.419+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311802.722","full_log":"type=LOGIN msg=audit(1670311801.424:22314): pid=9143 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3086 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22314","pid":"9143","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:30:02.419+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311802.722","full_log":"type=CRED_ACQ msg=audit(1670311801.424:22313): pid=9143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22313","pid":"9143","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:30:02.419+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311802.722","full_log":"type=CRED_REFR msg=audit(1670311801.448:22316): pid=9143 uid=0 auid=0 ses=3086 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22316","pid":"9143","uid":"0","auid":"0","session":"3086","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:30:02.419+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311802.722","full_log":"type=USER_START msg=audit(1670311801.447:22315): pid=9143 uid=0 auid=0 ses=3086 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22315","pid":"9143","uid":"0","auid":"0","session":"3086","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:30:02.419+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311802.722","full_log":"type=CRED_DISP msg=audit(1670311801.466:22317): pid=9143 uid=0 auid=0 ses=3086 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22317","pid":"9143","auid":"0","uid":"0","session":"3086","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:30:02.419+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311802.722","full_log":"type=USER_END msg=audit(1670311801.467:22318): pid=9143 uid=0 auid=0 ses=3086 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22318","pid":"9143","auid":"0","uid":"0","session":"3086","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:32:44.604+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311964.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:32:44.604+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311964.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:32:44.604+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311964.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:32:44.604+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311964.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:32:44.605+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311964.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:32:44.605+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311964.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781684  44625616      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:32:44.607+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":6,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670311964.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:26 (17+20:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:32 (17+20:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:26 (17+20:45)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:38:44.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312324.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:38:44.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312324.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:38:44.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312324.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:38:44.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312324.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:38:44.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312324.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781728  44625572      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:38:44.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312324.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:38:44.985+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":7,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312324.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:32 (17+20:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:38 (17+20:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:32 (17+20:51)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:40:03.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312403.722","full_log":"type=CRED_REFR msg=audit(1670312401.510:22323): pid=9187 uid=0 auid=0 ses=3087 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22323","pid":"9187","uid":"0","auid":"0","session":"3087","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:40:03.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312403.722","full_log":"type=LOGIN msg=audit(1670312401.489:22321): pid=9187 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3087 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22321","pid":"9187","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:40:03.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312403.722","full_log":"type=USER_START msg=audit(1670312401.509:22322): pid=9187 uid=0 auid=0 ses=3087 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22322","pid":"9187","uid":"0","auid":"0","session":"3087","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:40:03.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312403.722","full_log":"type=CRED_DISP msg=audit(1670312401.529:22324): pid=9187 uid=0 auid=0 ses=3087 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22324","pid":"9187","auid":"0","uid":"0","session":"3087","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:40:03.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312403.722","full_log":"type=USER_END msg=audit(1670312401.531:22325): pid=9187 uid=0 auid=0 ses=3087 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22325","pid":"9187","auid":"0","uid":"0","session":"3087","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:40:03.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312403.722","full_log":"type=USER_ACCT msg=audit(1670312401.489:22319): pid=9187 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22319","pid":"9187","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:40:03.059+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312403.722","full_log":"type=CRED_ACQ msg=audit(1670312401.489:22320): pid=9187 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22320","pid":"9187","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:44:45.329+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312685.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:44:45.329+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312685.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:44:45.329+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312685.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:44:45.329+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312685.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781792  44625508      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:44:45.329+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312685.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:44:45.329+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312685.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:44:45.332+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":8,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670312685.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:38 (17+20:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:44 (17+21:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:38 (17+20:57)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:50:01.670+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313001.722","full_log":"type=CRED_REFR msg=audit(1670313001.591:22330): pid=9223 uid=0 auid=0 ses=3088 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22330","pid":"9223","uid":"0","auid":"0","session":"3088","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:50:01.666+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313001.722","full_log":"type=LOGIN msg=audit(1670313001.565:22328): pid=9223 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3088 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22328","pid":"9223","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:50:01.665+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313001.722","full_log":"type=CRED_ACQ msg=audit(1670313001.565:22327): pid=9223 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22327","pid":"9223","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:50:01.670+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313001.722","full_log":"type=USER_START msg=audit(1670313001.589:22329): pid=9223 uid=0 auid=0 ses=3088 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22329","pid":"9223","uid":"0","auid":"0","session":"3088","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:50:01.670+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313001.722","full_log":"type=CRED_DISP msg=audit(1670313001.609:22331): pid=9223 uid=0 auid=0 ses=3088 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22331","pid":"9223","auid":"0","uid":"0","session":"3088","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:50:01.670+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313001.722","full_log":"type=USER_END msg=audit(1670313001.610:22332): pid=9223 uid=0 auid=0 ses=3088 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22332","pid":"9223","auid":"0","uid":"0","session":"3088","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:50:01.665+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313001.722","full_log":"type=USER_ACCT msg=audit(1670313001.565:22326): pid=9223 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22326","pid":"9223","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T07:50:45.719+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313045.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:50:45.719+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313045.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:50:45.719+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313045.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:50:45.719+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313045.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:50:45.719+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313045.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781792  44625508      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:50:45.719+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313045.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:50:45.727+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":9,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313045.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:44 (17+21:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:50 (17+21:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:44 (17+21:03)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T07:56:46.048+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313406.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:56:46.049+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313406.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:56:46.049+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313406.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:56:46.049+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313406.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:56:46.049+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313406.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:56:46.049+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313406.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781740  44625560      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T07:56:46.060+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":10,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313406.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:50 (17+21:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:56 (17+21:16)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:50 (17+21:09)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T08:00:02.269+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313602.722","full_log":"type=USER_ACCT msg=audit(1670313601.633:22333): pid=9269 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22333","pid":"9269","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:00:02.269+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313602.722","full_log":"type=CRED_ACQ msg=audit(1670313601.633:22334): pid=9269 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22334","pid":"9269","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:00:02.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313602.722","full_log":"type=LOGIN msg=audit(1670313601.634:22335): pid=9269 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3089 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22335","pid":"9269","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:00:02.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313602.722","full_log":"type=USER_START msg=audit(1670313601.652:22336): pid=9269 uid=0 auid=0 ses=3089 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22336","pid":"9269","uid":"0","auid":"0","session":"3089","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:00:02.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313602.722","full_log":"type=CRED_REFR msg=audit(1670313601.652:22337): pid=9269 uid=0 auid=0 ses=3089 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22337","pid":"9269","uid":"0","auid":"0","session":"3089","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:00:02.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313602.722","full_log":"type=CRED_DISP msg=audit(1670313601.668:22338): pid=9269 uid=0 auid=0 ses=3089 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22338","pid":"9269","auid":"0","uid":"0","session":"3089","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:00:02.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313602.722","full_log":"type=USER_END msg=audit(1670313601.670:22339): pid=9269 uid=0 auid=0 ses=3089 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22339","pid":"9269","auid":"0","uid":"0","session":"3089","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:01:02.323+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313662.722","full_log":"type=USER_ACCT msg=audit(1670313661.693:22340): pid=9278 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22340","pid":"9278","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:01:02.323+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313662.722","full_log":"type=USER_START msg=audit(1670313661.713:22343): pid=9278 uid=0 auid=0 ses=3090 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22343","pid":"9278","uid":"0","auid":"0","session":"3090","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:01:02.323+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313662.722","full_log":"type=CRED_ACQ msg=audit(1670313661.694:22341): pid=9278 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22341","pid":"9278","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:01:02.323+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313662.722","full_log":"type=LOGIN msg=audit(1670313661.694:22342): pid=9278 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3090 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22342","pid":"9278","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:01:02.323+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313662.722","full_log":"type=CRED_REFR msg=audit(1670313661.713:22344): pid=9278 uid=0 auid=0 ses=3090 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22344","pid":"9278","uid":"0","auid":"0","session":"3090","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:01:02.324+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313662.722","full_log":"type=CRED_DISP msg=audit(1670313661.746:22345): pid=9278 uid=0 auid=0 ses=3090 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22345","pid":"9278","auid":"0","uid":"0","session":"3090","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:01:02.324+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313662.722","full_log":"type=USER_END msg=audit(1670313661.749:22346): pid=9278 uid=0 auid=0 ses=3090 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22346","pid":"9278","auid":"0","uid":"0","session":"3090","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:02:46.413+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313766.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:02:46.413+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313766.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:02:46.413+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313766.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:02:46.413+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313766.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:02:46.413+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313766.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:02:46.413+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313766.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781920  44625380      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:02:46.428+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":1,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670313766.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:56 (17+21:16)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:02 (17+21:22)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 07:56 (17+21:16)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T08:08:46.770+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314126.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:08:46.771+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314126.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:08:46.771+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314126.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:08:46.771+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314126.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:08:46.771+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314126.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:08:46.771+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314126.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7781676  44625624      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:08:46.789+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":2,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314126.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:02 (17+21:22)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:08 (17+21:28)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:02 (17+21:22)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T08:10:02.869+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314202.722","full_log":"type=LOGIN msg=audit(1670314201.774:22349): pid=9329 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3091 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22349","pid":"9329","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:10:02.869+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314202.722","full_log":"type=USER_ACCT msg=audit(1670314201.773:22347): pid=9329 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22347","pid":"9329","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:10:02.869+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314202.722","full_log":"type=USER_START msg=audit(1670314201.798:22350): pid=9329 uid=0 auid=0 ses=3091 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22350","pid":"9329","uid":"0","auid":"0","session":"3091","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:10:02.869+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314202.722","full_log":"type=CRED_ACQ msg=audit(1670314201.773:22348): pid=9329 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22348","pid":"9329","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:10:02.869+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314202.722","full_log":"type=CRED_REFR msg=audit(1670314201.799:22351): pid=9329 uid=0 auid=0 ses=3091 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22351","pid":"9329","uid":"0","auid":"0","session":"3091","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:10:02.869+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314202.722","full_log":"type=CRED_DISP msg=audit(1670314201.816:22352): pid=9329 uid=0 auid=0 ses=3091 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22352","pid":"9329","auid":"0","uid":"0","session":"3091","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:10:02.869+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314202.722","full_log":"type=USER_END msg=audit(1670314201.818:22353): pid=9329 uid=0 auid=0 ses=3091 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22353","pid":"9329","auid":"0","uid":"0","session":"3091","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:14:47.184+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314487.722","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:14:47.184+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314487.722","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:14:47.184+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314487.722","full_log":"ossec: output: 'df -P': tmpfs              4086932   33484   4053448       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:14:47.184+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314487.722","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7782332  44624968      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:14:47.184+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314487.722","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:14:47.184+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314487.722","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:14:47.187+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":3,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314487.722","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:08 (17+21:28)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:14 (17+21:34)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:08 (17+21:28)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T08:16:17.256+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314577.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314576.500:22354): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:7b:f3:38:18:84:2e:1b:fc:cd:57:53:57:45:93:74:5e:cb:89:bc:d8:b4:a8:77:d0:15:e7:38:53:5a:3c:77:db direction=? spid=9374 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22354","pid":"9374","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:17.256+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314577.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314576.501:22355): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:9c:c2:78:e4:35:6d:d6:05:11:1e:97:76:41:80:ae:f4:99:48:88:12:93:ca:76:33:06:06:1c:2f:17:b6:ee:16 direction=? spid=9374 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22355","pid":"9374","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:17.256+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314577.722","full_log":"type=CRYPTO_SESSION msg=audit(1670314576.539:22358): pid=9373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes256-ctr ksize=256 mac=hmac-sha2-256 pfs=curve25519-sha256@libssh.org spid=9374 suid=74 rport=41896 laddr=192.168.61.147 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRYPTO_SESSION","id":"22358","pid":"9373","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:17.256+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314577.722","full_log":"type=CRYPTO_SESSION msg=audit(1670314576.539:22357): pid=9373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 mac=hmac-sha2-256 pfs=curve25519-sha256@libssh.org spid=9374 suid=74 rport=41896 laddr=192.168.61.147 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRYPTO_SESSION","id":"22357","pid":"9373","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:17.256+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314577.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314576.501:22356): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:b3:26:d6:7c:9b:41:96:25:25:e6:e8:e2:64:2e:3a:70:61:48:fb:94:fb:64:b5:ae:89:4e:56:54:54:02:c0:4d direction=? spid=9374 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22356","pid":"9374","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=USER_AUTH msg=audit(1670314587.407:22359): pid=9373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_AUTH","id":"22359","pid":"9373","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=USER_AUTH msg=audit(1670314587.425:22362): pid=9373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_AUTH","id":"22362","pid":"9373","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314587.423:22361): pid=9373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=9374 suid=74 rport=41896 laddr=192.168.61.147 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRYPTO_KEY_USER","id":"22361","pid":"9373","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=LOGIN msg=audit(1670314587.426:22364): pid=9373 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=1000 tty=(none) old-ses=4294967295 ses=3092 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22364","pid":"9373","uid":"0","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=CRED_ACQ msg=audit(1670314587.426:22363): pid=9373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRED_ACQ","id":"22363","pid":"9373","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=USER_START msg=audit(1670314587.580:22366): pid=9373 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_START","id":"22366","pid":"9373","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=USER_ROLE_CHANGE msg=audit(1670314587.556:22365): pid=9373 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_ROLE_CHANGE","id":"22365","pid":"9373","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314587.581:22367): pid=9378 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:7b:f3:38:18:84:2e:1b:fc:cd:57:53:57:45:93:74:5e:cb:89:bc:d8:b4:a8:77:d0:15:e7:38:53:5a:3c:77:db direction=? spid=9378 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22367","pid":"9378","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314587.582:22368): pid=9378 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:9c:c2:78:e4:35:6d:d6:05:11:1e:97:76:41:80:ae:f4:99:48:88:12:93:ca:76:33:06:06:1c:2f:17:b6:ee:16 direction=? spid=9378 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22368","pid":"9378","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=USER_ACCT msg=audit(1670314587.422:22360): pid=9373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_ACCT","id":"22360","pid":"9373","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314587.582:22369): pid=9378 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:b3:26:d6:7c:9b:41:96:25:25:e6:e8:e2:64:2e:3a:70:61:48:fb:94:fb:64:b5:ae:89:4e:56:54:54:02:c0:4d direction=? spid=9378 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22369","pid":"9378","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=CRED_ACQ msg=audit(1670314587.584:22370): pid=9378 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRED_ACQ","id":"22370","pid":"9378","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=USER_START msg=audit(1670314588.125:22372): pid=9373 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=/dev/pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_START","id":"22372","pid":"9373","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=USER_LOGIN msg=audit(1670314588.125:22371): pid=9373 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=/dev/pts/0 res=success'","decoder":{"name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_LOGIN","id":"22371","pid":"9373","auid":"1000","uid":"0","session":"3092","exe":"/usr/sbin/sshd","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"type=CRYPTO_KEY_USER msg=audit(1670314588.132:22373): pid=9373 uid=0 auid=1000 ses=3092 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:b3:26:d6:7c:9b:41:96:25:25:e6:e8:e2:64:2e:3a:70:61:48:fb:94:fb:64:b5:ae:89:4e:56:54:54:02:c0:4d direction=? spid=9379 suid=1000  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22373","pid":"9373","uid":"0","auid":"1000","session":"3092","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:16:29.270+0000","rule":{"level":3,"description":"PAM: Login session opened.","id":"5501","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":1,"mail":false,"groups":["pam","syslog","authentication_success"],"pci_dss":["10.2.5"],"gpg13":["7.8","7.9"],"gdpr":["IV_32.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"Dec  6 08:16:27 wazuh-server sshd[9373]: pam_unix(sshd:session): session opened for user wazuh-user by (uid=0)","predecoder":{"program_name":"sshd","timestamp":"Dec  6 08:16:27","hostname":"wazuh-server"},"decoder":{"parent":"pam","name":"pam"},"data":{"dstuser":"wazuh-user","uid":"0"},"location":"/var/log/secure"}
{"timestamp":"2022-12-06T08:16:29.270+0000","rule":{"level":3,"description":"sshd: authentication success.","id":"5715","mitre":{"id":["T1078","T1021"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Lateral Movement"],"technique":["Valid Accounts","Remote Services"]},"firedtimes":1,"mail":false,"groups":["syslog","sshd","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314589.722","full_log":"Dec  6 08:16:27 wazuh-server sshd[9373]: Accepted password for wazuh-user from 192.168.136.52 port 41896 ssh2","predecoder":{"program_name":"sshd","timestamp":"Dec  6 08:16:27","hostname":"wazuh-server"},"decoder":{"parent":"sshd","name":"sshd"},"data":{"srcip":"192.168.136.52","srcport":"41896","dstuser":"wazuh-user"},"location":"/var/log/secure"}
{"timestamp":"2022-12-06T08:20:03.494+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314803.429","full_log":"type=USER_ACCT msg=audit(1670314801.846:22374): pid=9411 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22374","pid":"9411","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:20:03.494+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314803.429","full_log":"type=LOGIN msg=audit(1670314801.847:22376): pid=9411 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=3093 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22376","pid":"9411","uid":"0","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:20:03.494+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314803.429","full_log":"type=CRED_ACQ msg=audit(1670314801.846:22375): pid=9411 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22375","pid":"9411","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:20:03.494+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314803.429","full_log":"type=CRED_DISP msg=audit(1670314801.895:22379): pid=9411 uid=0 auid=0 ses=3093 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_DISP","id":"22379","pid":"9411","auid":"0","uid":"0","session":"3093","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:20:03.494+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314803.429","full_log":"type=USER_START msg=audit(1670314801.867:22377): pid=9411 uid=0 auid=0 ses=3093 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22377","pid":"9411","uid":"0","auid":"0","session":"3093","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:20:03.494+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314803.429","full_log":"type=CRED_REFR msg=audit(1670314801.867:22378): pid=9411 uid=0 auid=0 ses=3093 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22378","pid":"9411","uid":"0","auid":"0","session":"3093","subj":"system_u:system_r:crond_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/sbin/crond"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:20:03.494+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314803.429","full_log":"type=USER_END msg=audit(1670314801.896:22380): pid=9411 uid=0 auid=0 ses=3093 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'","decoder":{"name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_END","id":"22380","pid":"9411","auid":"0","uid":"0","session":"3093","exe":"/usr/sbin/crond","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:20:47.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:20:47.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:20:47.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","full_log":"ossec: output: 'df -P': tmpfs              4086932   33540   4053392       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:20:47.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","full_log":"ossec: output: 'df -P': tmpfs               817388       0    817388       0% /run/user/1000","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:20:47.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7780632  44626668      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:20:47.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:20:47.556+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:20:47.565+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":4,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670314847.429","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:14 (17+21:34)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.52   Tue Dec  6 08:16   still logged in   \nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:20 (17+21:40)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:14 (17+21:34)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwazuh-us pts/0        192.168.136.93   Wed Oct 19 09:54 - 13:35  (03:41)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T08:25:59.574+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":1,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.895","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T12:00:02.1454042Z\",\"eventRecordID\":\"9446\",\"processID\":\"1136\",\"threadID\":\"10464\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T12:00:02.1454042Z","eventRecordID":"9446","processID":"1136","threadID":"10464","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.574+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":2,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.3374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T12:00:02.2044255Z\",\"eventRecordID\":\"9447\",\"processID\":\"1136\",\"threadID\":\"1152\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T12:00:02.2044255Z","eventRecordID":"9447","processID":"1136","threadID":"1152","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.589+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":3,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.5856","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T12:00:02.2070101Z\",\"eventRecordID\":\"9448\",\"processID\":\"1136\",\"threadID\":\"20240\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T12:00:02.2070101Z","eventRecordID":"9448","processID":"1136","threadID":"20240","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.604+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":4,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.8342","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T12:00:02.6603459Z\",\"eventRecordID\":\"9449\",\"processID\":\"1136\",\"threadID\":\"14152\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T12:00:02.6603459Z","eventRecordID":"9449","processID":"1136","threadID":"14152","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.619+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":5,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.10822","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T12:00:02.7202656Z\",\"eventRecordID\":\"9450\",\"processID\":\"1136\",\"threadID\":\"20240\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T12:00:02.7202656Z","eventRecordID":"9450","processID":"1136","threadID":"20240","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.634+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":6,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.13307","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T12:00:02.7228603Z\",\"eventRecordID\":\"9451\",\"processID\":\"1136\",\"threadID\":\"20064\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T12:00:02.7228603Z","eventRecordID":"9451","processID":"1136","threadID":"20064","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.648+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":7,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.15794","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:00:02.6642527Z\",\"eventRecordID\":\"9452\",\"processID\":\"1136\",\"threadID\":\"4920\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:00:02.6642527Z","eventRecordID":"9452","processID":"1136","threadID":"4920","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.665+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":8,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.18273","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:00:02.7236948Z\",\"eventRecordID\":\"9453\",\"processID\":\"1136\",\"threadID\":\"17144\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:00:02.7236948Z","eventRecordID":"9453","processID":"1136","threadID":"17144","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.679+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":9,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.20758","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:00:02.7261638Z\",\"eventRecordID\":\"9454\",\"processID\":\"1136\",\"threadID\":\"18596\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:00:02.7261638Z","eventRecordID":"9454","processID":"1136","threadID":"18596","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.695+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":10,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.23245","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:00:02.6541834Z\",\"eventRecordID\":\"9459\",\"processID\":\"1136\",\"threadID\":\"16880\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:00:02.6541834Z","eventRecordID":"9459","processID":"1136","threadID":"16880","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.728+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":11,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.25726","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:00:02.7157812Z\",\"eventRecordID\":\"9460\",\"processID\":\"1136\",\"threadID\":\"19504\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:00:02.7157812Z","eventRecordID":"9460","processID":"1136","threadID":"19504","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.730+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":12,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.25726","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:00:02.7183440Z\",\"eventRecordID\":\"9461\",\"processID\":\"1136\",\"threadID\":\"19504\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:00:02.7183440Z","eventRecordID":"9461","processID":"1136","threadID":"19504","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.759+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":13,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.30698","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:00:02.6223137Z\",\"eventRecordID\":\"9471\",\"processID\":\"1136\",\"threadID\":\"17728\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:00:02.6223137Z","eventRecordID":"9471","processID":"1136","threadID":"17728","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.761+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":14,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.33179","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:00:02.6809318Z\",\"eventRecordID\":\"9472\",\"processID\":\"1136\",\"threadID\":\"17728\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:00:02.6809318Z","eventRecordID":"9472","processID":"1136","threadID":"17728","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.811+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":15,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.35664","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:00:02.6833541Z\",\"eventRecordID\":\"9473\",\"processID\":\"1136\",\"threadID\":\"4440\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:00:02.6833541Z","eventRecordID":"9473","processID":"1136","threadID":"4440","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.814+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {635DC7B9-9E3A-4A13-AAC1-DD22ED84D50F} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":1,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.38149","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3617816Z\",\"eventRecordID\":\"9474\",\"processID\":\"1136\",\"threadID\":\"19196\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{635DC7B9-9E3A-4A13-AAC1-DD22ED84D50F}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{635DC7B9-9E3A-4A13-AAC1-DD22ED84D50F}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3617816Z","eventRecordID":"9474","processID":"1136","threadID":"19196","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{635DC7B9-9E3A-4A13-AAC1-DD22ED84D50F}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{635DC7B9-9E3A-4A13-AAC1-DD22ED84D50F}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.851+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {94321C24-7BB7-411E-9D85-9AA0DC982E08} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":2,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.40645","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3643279Z\",\"eventRecordID\":\"9475\",\"processID\":\"1136\",\"threadID\":\"19196\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{94321C24-7BB7-411E-9D85-9AA0DC982E08}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{94321C24-7BB7-411E-9D85-9AA0DC982E08}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3643279Z","eventRecordID":"9475","processID":"1136","threadID":"19196","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{94321C24-7BB7-411E-9D85-9AA0DC982E08}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{94321C24-7BB7-411E-9D85-9AA0DC982E08}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.852+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {67D72606-C70C-4B17-A11B-19E08A0AB907} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":3,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.40645","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3688482Z\",\"eventRecordID\":\"9476\",\"processID\":\"1136\",\"threadID\":\"19196\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{67D72606-C70C-4B17-A11B-19E08A0AB907}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{67D72606-C70C-4B17-A11B-19E08A0AB907}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3688482Z","eventRecordID":"9476","processID":"1136","threadID":"19196","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{67D72606-C70C-4B17-A11B-19E08A0AB907}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{67D72606-C70C-4B17-A11B-19E08A0AB907}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.860+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {4CB98634-3BA3-4571-B2BA-520361A0130D} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":4,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.45637","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3731793Z\",\"eventRecordID\":\"9477\",\"processID\":\"1136\",\"threadID\":\"19324\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{4CB98634-3BA3-4571-B2BA-520361A0130D}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{4CB98634-3BA3-4571-B2BA-520361A0130D}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3731793Z","eventRecordID":"9477","processID":"1136","threadID":"19324","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{4CB98634-3BA3-4571-B2BA-520361A0130D}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{4CB98634-3BA3-4571-B2BA-520361A0130D}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.876+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {D78560BA-638D-46C3-944B-CBCE5A914B50} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":5,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.45637","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3763729Z\",\"eventRecordID\":\"9478\",\"processID\":\"1136\",\"threadID\":\"19324\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{D78560BA-638D-46C3-944B-CBCE5A914B50}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{D78560BA-638D-46C3-944B-CBCE5A914B50}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3763729Z","eventRecordID":"9478","processID":"1136","threadID":"19324","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{D78560BA-638D-46C3-944B-CBCE5A914B50}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{D78560BA-638D-46C3-944B-CBCE5A914B50}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.877+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {0368AA5C-B513-4D9E-B19F-CED877727A70} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":6,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.50629","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3793934Z\",\"eventRecordID\":\"9479\",\"processID\":\"1136\",\"threadID\":\"19324\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{0368AA5C-B513-4D9E-B19F-CED877727A70}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{0368AA5C-B513-4D9E-B19F-CED877727A70}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3793934Z","eventRecordID":"9479","processID":"1136","threadID":"19324","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{0368AA5C-B513-4D9E-B19F-CED877727A70}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{0368AA5C-B513-4D9E-B19F-CED877727A70}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.888+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {B540087D-9CAD-433C-913F-9E204CD76ACE} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":7,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.53125","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3824553Z\",\"eventRecordID\":\"9480\",\"processID\":\"1136\",\"threadID\":\"10960\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{B540087D-9CAD-433C-913F-9E204CD76ACE}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{B540087D-9CAD-433C-913F-9E204CD76ACE}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3824553Z","eventRecordID":"9480","processID":"1136","threadID":"10960","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{B540087D-9CAD-433C-913F-9E204CD76ACE}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{B540087D-9CAD-433C-913F-9E204CD76ACE}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.906+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: {279914A7-0C3A-4835-91B3-F30DCE2D1921} rule has been deleted in the Windows Defender Firewall exception list.","id":"67008","firedtimes":8,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.55621","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2006\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000020000000000\",\"systemTime\":\"2022-12-02T15:09:56.3856904Z\",\"eventRecordID\":\"9481\",\"processID\":\"1136\",\"threadID\":\"10960\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\\r\\n\\r\\nUsunięta reguła:\\r\\n\\tIdentyfikator reguły\\t{279914A7-0C3A-4835-91B3-F30DCE2D1921}\\r\\n\\tNazwa reguły:\\tSpotify Music\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"ruleId\":\"{279914A7-0C3A-4835-91B3-F30DCE2D1921}\",\"ruleName\":\"Spotify Music\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2006","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000020000000000","systemTime":"2022-12-02T15:09:56.3856904Z","eventRecordID":"9481","processID":"1136","threadID":"10960","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usunięto regułę z listy wyjątków Zapory Windows Defender.\r\n\r\nUsunięta reguła:\r\n\tIdentyfikator reguły\t{279914A7-0C3A-4835-91B3-F30DCE2D1921}\r\n\tNazwa reguły:\tSpotify Music\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"ruleId":"{279914A7-0C3A-4835-91B3-F30DCE2D1921}","ruleName":"Spotify Music","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.913+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":16,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.55621","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:00:02.6639381Z\",\"eventRecordID\":\"9487\",\"processID\":\"1136\",\"threadID\":\"19920\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:00:02.6639381Z","eventRecordID":"9487","processID":"1136","threadID":"19920","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:25:59.977+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":17,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315159.60598","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:00:02.7225018Z\",\"eventRecordID\":\"9488\",\"processID\":\"1136\",\"threadID\":\"17324\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:00:02.7225018Z","eventRecordID":"9488","processID":"1136","threadID":"17324","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.066+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":18,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.63083","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:00:02.7252196Z\",\"eventRecordID\":\"9489\",\"processID\":\"1136\",\"threadID\":\"19700\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:00:02.7252196Z","eventRecordID":"9489","processID":"1136","threadID":"19700","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.068+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":19,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.65570","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:00:02.6665445Z\",\"eventRecordID\":\"9501\",\"processID\":\"1136\",\"threadID\":\"10356\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:00:02.6665445Z","eventRecordID":"9501","processID":"1136","threadID":"10356","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.094+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":20,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.65570","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:00:02.7248467Z\",\"eventRecordID\":\"9502\",\"processID\":\"1136\",\"threadID\":\"10356\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:00:02.7248467Z","eventRecordID":"9502","processID":"1136","threadID":"10356","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.095+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":21,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.68051","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:00:02.7275791Z\",\"eventRecordID\":\"9503\",\"processID\":\"1136\",\"threadID\":\"6600\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:00:02.7275791Z","eventRecordID":"9503","processID":"1136","threadID":"6600","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.115+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":22,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.70536","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:00:02.6608264Z\",\"eventRecordID\":\"9513\",\"processID\":\"1136\",\"threadID\":\"18568\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:00:02.6608264Z","eventRecordID":"9513","processID":"1136","threadID":"18568","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.181+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":23,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.73021","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:00:02.7190108Z\",\"eventRecordID\":\"9514\",\"processID\":\"1136\",\"threadID\":\"18112\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:00:02.7190108Z","eventRecordID":"9514","processID":"1136","threadID":"18112","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.182+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":24,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.77987","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:00:02.7217946Z\",\"eventRecordID\":\"9515\",\"processID\":\"1136\",\"threadID\":\"18112\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:00:02.7217946Z","eventRecordID":"9515","processID":"1136","threadID":"18112","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.239+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":25,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.80474","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:00:02.6637339Z\",\"eventRecordID\":\"9527\",\"processID\":\"1136\",\"threadID\":\"16288\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:00:02.6637339Z","eventRecordID":"9527","processID":"1136","threadID":"16288","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.240+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":26,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.82955","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:00:02.7223906Z\",\"eventRecordID\":\"9528\",\"processID\":\"1136\",\"threadID\":\"3396\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:00:02.7223906Z","eventRecordID":"9528","processID":"1136","threadID":"3396","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.296+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":27,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.85438","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:00:02.7252684Z\",\"eventRecordID\":\"9529\",\"processID\":\"1136\",\"threadID\":\"3396\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:00:02.7252684Z","eventRecordID":"9529","processID":"1136","threadID":"3396","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.297+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":28,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.87923","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:00:02.6179606Z\",\"eventRecordID\":\"9541\",\"processID\":\"1136\",\"threadID\":\"17908\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:00:02.6179606Z","eventRecordID":"9541","processID":"1136","threadID":"17908","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.355+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":29,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.87923","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:00:02.6800812Z\",\"eventRecordID\":\"9543\",\"processID\":\"1136\",\"threadID\":\"8312\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:00:02.6800812Z","eventRecordID":"9543","processID":"1136","threadID":"8312","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.354+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":30,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.92889","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:00:02.6770195Z\",\"eventRecordID\":\"9542\",\"processID\":\"1136\",\"threadID\":\"16664\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:00:02.6770195Z","eventRecordID":"9542","processID":"1136","threadID":"16664","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.374+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":31,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.95374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:00:02.6440630Z\",\"eventRecordID\":\"9553\",\"processID\":\"1136\",\"threadID\":\"6088\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:00:02.6440630Z","eventRecordID":"9553","processID":"1136","threadID":"6088","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.389+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":32,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.97853","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:00:02.7039654Z\",\"eventRecordID\":\"9554\",\"processID\":\"1136\",\"threadID\":\"6088\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:00:02.7039654Z","eventRecordID":"9554","processID":"1136","threadID":"6088","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.390+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":33,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.100336","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:00:02.7065561Z\",\"eventRecordID\":\"9555\",\"processID\":\"1136\",\"threadID\":\"16320\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:00:02.7065561Z","eventRecordID":"9555","processID":"1136","threadID":"16320","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.464+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":34,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.102824","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:00:02.6425335Z\",\"eventRecordID\":\"9567\",\"processID\":\"1136\",\"threadID\":\"19476\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:00:02.6425335Z","eventRecordID":"9567","processID":"1136","threadID":"19476","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.465+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":35,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.105306","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:00:02.7260564Z\",\"eventRecordID\":\"9568\",\"processID\":\"1136\",\"threadID\":\"19476\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:00:02.7260564Z","eventRecordID":"9568","processID":"1136","threadID":"19476","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.540+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":36,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.107792","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:00:02.7287603Z\",\"eventRecordID\":\"9569\",\"processID\":\"1136\",\"threadID\":\"14804\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:00:02.7287603Z","eventRecordID":"9569","processID":"1136","threadID":"14804","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.541+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":37,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.110280","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T23:00:02.6342302Z\",\"eventRecordID\":\"9575\",\"processID\":\"1136\",\"threadID\":\"17516\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T23:00:02.6342302Z","eventRecordID":"9575","processID":"1136","threadID":"17516","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.552+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":38,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.112762","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T23:00:02.6932125Z\",\"eventRecordID\":\"9576\",\"processID\":\"1136\",\"threadID\":\"18480\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T23:00:02.6932125Z","eventRecordID":"9576","processID":"1136","threadID":"18480","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.553+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":39,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.112762","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T23:00:02.6961519Z\",\"eventRecordID\":\"9577\",\"processID\":\"1136\",\"threadID\":\"19440\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T23:00:02.6961519Z","eventRecordID":"9577","processID":"1136","threadID":"19440","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.564+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":40,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.117736","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:47.3958646Z\",\"eventRecordID\":\"9580\",\"processID\":\"1136\",\"threadID\":\"8464\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"1\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:47.3958646Z","eventRecordID":"9580","processID":"1136","threadID":"8464","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Domena zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"1","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.566+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":41,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.120216","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:47.4006257Z\",\"eventRecordID\":\"9581\",\"processID\":\"1136\",\"threadID\":\"18480\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"2\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:47.4006257Z","eventRecordID":"9581","processID":"1136","threadID":"18480","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Prywatne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"2","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.574+0000","rule":{"level":7,"description":"Windows Firewall With Advanced Security: Windows Defender Firewall enabled.","id":"67004","firedtimes":42,"mail":false,"groups":["windows","windows_firewall","firewall"],"pci_dss":["1.4"],"gpg13":["4.12"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.a.1"],"nist_800_53":["SC.7"],"tsc":["CC6.7","CC6.8"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.120216","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Windows Firewall With Advanced Security\",\"providerGuid\":\"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}\",\"eventID\":\"2003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:47.4537624Z\",\"eventRecordID\":\"9582\",\"processID\":\"1136\",\"threadID\":\"17516\",\"channel\":\"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\\r\\nNowe ustawienie:\\r\\n\\tTyp:\\tWłącz Zaporę Windows Defender\\r\\n\\tWartość:\\tTak\\r\\n\\tModyfikujący użytkownik:\\tS-1-5-18\\r\\n\\tModyfikująca aplikacja:\\tC:\\\\Windows\\\\System32\\\\netsh.exe\\\"\"},\"eventdata\":{\"profiles\":\"4\",\"settingType\":\"1\",\"settingValueSize\":\"4\",\"settingValue\":\"01000000\",\"settingValueString\":\"Tak\",\"origin\":\"1\",\"modifyingUser\":\"S-1-5-18\",\"modifyingApplication\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Windows Firewall With Advanced Security","providerGuid":"{d1bc9aff-2abf-4d71-9146-ecb2a986eb85}","eventID":"2003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:47.4537624Z","eventRecordID":"9582","processID":"1136","threadID":"17516","channel":"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Ustawienie Zapory Windows Defender w profilu Publiczne zostało zmienione.\r\nNowe ustawienie:\r\n\tTyp:\tWłącz Zaporę Windows Defender\r\n\tWartość:\tTak\r\n\tModyfikujący użytkownik:\tS-1-5-18\r\n\tModyfikująca aplikacja:\tC:\\Windows\\System32\\netsh.exe\""},"eventdata":{"profiles":"4","settingType":"1","settingValueSize":"4","settingValue":"01000000","settingValueString":"Tak","origin":"1","modifyingUser":"S-1-5-18","modifyingApplication":"C:\\\\Windows\\\\System32\\\\netsh.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.837+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.122702","full_log":"Starting rootcheck scan.","decoder":{"name":"rootcheck"},"data":{"title":"Starting rootcheck scan."},"location":"rootcheck"}
{"timestamp":"2022-12-06T08:26:00.963+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:21:12.2718344Z\",\"eventRecordID\":\"7232\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:21:12.2718344Z","eventRecordID":"7232","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.963+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:11.4800678Z\",\"eventRecordID\":\"10493\",\"processID\":\"1592\",\"threadID\":\"14800\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:11.4800678Z","eventRecordID":"10493","processID":"1592","threadID":"14800","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.964+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"24\",\"version\":\"0\",\"level\":\"4\",\"task\":\"11\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T11:21:12.2583262Z\",\"eventRecordID\":\"10494\",\"processID\":\"1592\",\"threadID\":\"1596\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Informacje dotyczące strefy czasowej zostały z odświeżone. Przyczyna zakończenia: 0. Aktualna różnica stref czasowych: -60.\\\"\"},\"eventdata\":{\"exitReason\":\"0\",\"currentBias\":\"-60\",\"currentTimeZoneID\":\"1\",\"timeZoneInfoCacheUpdated\":\"0\",\"firstRefresh\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"24","version":"0","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T11:21:12.2583262Z","eventRecordID":"10494","processID":"1592","threadID":"1596","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Informacje dotyczące strefy czasowej zostały z odświeżone. Przyczyna zakończenia: 0. Aktualna różnica stref czasowych: -60.\""},"eventdata":{"exitReason":"0","currentBias":"-60","currentTimeZoneID":"1","timeZoneInfoCacheUpdated":"0","firstRefresh":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.974+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T11:21:12.2583505Z\",\"eventRecordID\":\"10495\",\"processID\":\"1592\",\"threadID\":\"1596\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T11:21:12.256054400Z na ‎2022‎-‎12‎-‎02T11:21:12.258098500Z.\\r\\n\\r\\nPrzyczyna zmiany: An application or system component changed the time.\\r\\nProces: „\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe” (identyfikator PID: 1592).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T11:21:12.2580985Z\",\"oldTime\":\"2022-12-02T11:21:12.2560544Z\",\"reason\":\"1\",\"processName\":\"\\\\\\\\Device\\\\\\\\HarddiskVolume3\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"processID\":\"1592\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T11:21:12.2583505Z","eventRecordID":"10495","processID":"1592","threadID":"1596","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T11:21:12.256054400Z na ‎2022‎-‎12‎-‎02T11:21:12.258098500Z.\r\n\r\nPrzyczyna zmiany: An application or system component changed the time.\r\nProces: „\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe” (identyfikator PID: 1592).\""},"eventdata":{"newTime":"2022-12-02T11:21:12.2580985Z","oldTime":"2022-12-02T11:21:12.2560544Z","reason":"1","processName":"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe","processID":"1592"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:00.974+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315160.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T11:21:12.8521365Z\",\"eventRecordID\":\"10496\",\"processID\":\"4\",\"threadID\":\"18008\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"289\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T11:21:12.8521365Z","eventRecordID":"10496","processID":"4","threadID":"18008","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"289"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.019+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:13.2931166Z\",\"eventRecordID\":\"10497\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:13.2931166Z","eventRecordID":"10497","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.020+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:21:40.9588189Z\",\"eventRecordID\":\"7233\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:21:40.9588189Z","eventRecordID":"7233","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.021+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T11:21:13.4246031Z\",\"eventRecordID\":\"10498\",\"processID\":\"4\",\"threadID\":\"18008\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T11:21:13.4246031Z","eventRecordID":"10498","processID":"4","threadID":"18008","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.055+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T11:21:40.5005978Z\",\"eventRecordID\":\"10499\",\"processID\":\"4\",\"threadID\":\"18008\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T11:21:13.424564200Z na ‎2022‎-‎12‎-‎02T11:21:40.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T11:21:40.5000000Z\",\"oldTime\":\"2022-12-02T11:21:13.4245642Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T11:21:40.5005978Z","eventRecordID":"10499","processID":"4","threadID":"18008","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T11:21:13.424564200Z na ‎2022‎-‎12‎-‎02T11:21:40.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T11:21:40.5000000Z","oldTime":"2022-12-02T11:21:13.4245642Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.055+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:40.5633576Z\",\"eventRecordID\":\"10500\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:40.5633576Z","eventRecordID":"10500","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.059+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T11:21:40.6528804Z\",\"eventRecordID\":\"10501\",\"processID\":\"4\",\"threadID\":\"18008\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 145, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"145\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T11:21:40.6528804Z","eventRecordID":"10501","processID":"4","threadID":"18008","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 145, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"145","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.126+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:40.9467317Z\",\"eventRecordID\":\"10502\",\"processID\":\"1592\",\"threadID\":\"14800\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:40.9467317Z","eventRecordID":"10502","processID":"1592","threadID":"14800","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.128+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:40.9943963Z\",\"eventRecordID\":\"10503\",\"processID\":\"1592\",\"threadID\":\"14800\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:40.9943963Z","eventRecordID":"10503","processID":"1592","threadID":"14800","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.181+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:21:40.9979739Z\",\"eventRecordID\":\"7234\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:21:40.9979739Z","eventRecordID":"7234","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.180+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:42.8812775Z\",\"eventRecordID\":\"10504\",\"processID\":\"3908\",\"threadID\":\"1672\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T11:21:05.636656700Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T11:21:41.130503500Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T11:21:05.6366567Z\",\"wakeTime\":\"2022-12-02T11:21:41.1305035Z\",\"sleepDuration\":\"7514\",\"wakeDuration\":\"629\",\"driverInitDuration\":\"231\",\"biosInitDuration\":\"481\",\"hiberWriteDuration\":\"7122\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"278070\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"41\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:42.8812775Z","eventRecordID":"10504","processID":"3908","threadID":"1672","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T11:21:05.636656700Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T11:21:41.130503500Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T11:21:05.6366567Z","wakeTime":"2022-12-02T11:21:41.1305035Z","sleepDuration":"7514","wakeDuration":"629","driverInitDuration":"231","biosInitDuration":"481","hiberWriteDuration":"7122","hiberReadDuration":"0","hiberPagesWritten":"278070","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"41"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.213+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T11:21:44.2554705Z\",\"eventRecordID\":\"10505\",\"processID\":\"1144\",\"threadID\":\"7280\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T11:21:44.2554705Z","eventRecordID":"10505","processID":"1144","threadID":"7280","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.222+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T11:21:48.9030672Z\",\"eventRecordID\":\"10506\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T11:21:48.9030672Z","eventRecordID":"10506","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.266+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:49.5458445Z\",\"eventRecordID\":\"10507\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:49.5458445Z","eventRecordID":"10507","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.267+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.122702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:21:51.0536970Z\",\"eventRecordID\":\"10508\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:21:51.0536970Z","eventRecordID":"10508","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.345+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":1,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.125190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:29:27.2102738Z\",\"eventRecordID\":\"10509\",\"processID\":\"20472\",\"threadID\":\"11440\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"16\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:29:27.2102738Z","eventRecordID":"10509","processID":"20472","threadID":"11440","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"16","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.347+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.125190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1500\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:29:27.2104321Z\",\"eventRecordID\":\"10510\",\"processID\":\"20472\",\"threadID\":\"11440\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"16\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1500","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:29:27.2104321Z","eventRecordID":"10510","processID":"20472","threadID":"11440","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"16"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.376+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.125190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T11:31:26.7627351Z\",\"eventRecordID\":\"10511\",\"processID\":\"1144\",\"threadID\":\"1764\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T11:31:26.7627351Z","eventRecordID":"10511","processID":"1144","threadID":"1764","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.439+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.125190","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:21:59.5697196Z\",\"eventRecordID\":\"7235\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:21:59.5697196Z","eventRecordID":"7235","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.440+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":2,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.125190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:46:07.4736460Z\",\"eventRecordID\":\"10512\",\"processID\":\"17512\",\"threadID\":\"19584\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"141\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:46:07.4736460Z","eventRecordID":"10512","processID":"17512","threadID":"19584","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"141","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.445+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1501\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:46:07.4740086Z\",\"eventRecordID\":\"10513\",\"processID\":\"17512\",\"threadID\":\"19584\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"141\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1501","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:46:07.4740086Z","eventRecordID":"10513","processID":"17512","threadID":"19584","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"141"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.508+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T11:53:36.3330820Z\",\"eventRecordID\":\"10515\",\"processID\":\"4\",\"threadID\":\"19792\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T11:53:36.3330820Z","eventRecordID":"10515","processID":"4","threadID":"19792","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.508+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T11:53:35.8087238Z\",\"eventRecordID\":\"10514\",\"processID\":\"4\",\"threadID\":\"19792\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"291\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T11:53:35.8087238Z","eventRecordID":"10514","processID":"4","threadID":"19792","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"291"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.512+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T11:54:05.5003045Z\",\"eventRecordID\":\"10516\",\"processID\":\"4\",\"threadID\":\"19792\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T11:53:36.333039700Z na ‎2022‎-‎12‎-‎02T11:54:05.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T11:54:05.5000000Z\",\"oldTime\":\"2022-12-02T11:53:36.3330397Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T11:54:05.5003045Z","eventRecordID":"10516","processID":"4","threadID":"19792","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T11:53:36.333039700Z na ‎2022‎-‎12‎-‎02T11:54:05.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T11:54:05.5000000Z","oldTime":"2022-12-02T11:53:36.3330397Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.568+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:22:02.3120979Z\",\"eventRecordID\":\"7236\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:22:02.3120979Z","eventRecordID":"7236","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.568+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T11:54:05.6642511Z\",\"eventRecordID\":\"10517\",\"processID\":\"4\",\"threadID\":\"19792\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 146, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"146\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T11:54:05.6642511Z","eventRecordID":"10517","processID":"4","threadID":"19792","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 146, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"146","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.575+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T11:54:06.0242917Z\",\"eventRecordID\":\"10518\",\"processID\":\"1144\",\"threadID\":\"13228\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T11:54:06.0242917Z","eventRecordID":"10518","processID":"1144","threadID":"13228","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.585+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:54:07.9135503Z\",\"eventRecordID\":\"10519\",\"processID\":\"3908\",\"threadID\":\"13816\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T11:53:32.708524400Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T11:54:06.117949500Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T11:53:32.7085244Z\",\"wakeTime\":\"2022-12-02T11:54:06.1179495Z\",\"sleepDuration\":\"3354\",\"wakeDuration\":\"622\",\"driverInitDuration\":\"234\",\"biosInitDuration\":\"482\",\"hiberWriteDuration\":\"7238\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"276721\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"34\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:54:07.9135503Z","eventRecordID":"10519","processID":"3908","threadID":"13816","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T11:53:32.708524400Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T11:54:06.117949500Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T11:53:32.7085244Z","wakeTime":"2022-12-02T11:54:06.1179495Z","sleepDuration":"3354","wakeDuration":"622","driverInitDuration":"234","biosInitDuration":"482","hiberWriteDuration":"7238","hiberReadDuration":"0","hiberPagesWritten":"276721","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"34"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.592+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T11:54:11.8946835Z\",\"eventRecordID\":\"10520\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T11:54:11.8946835Z","eventRecordID":"10520","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.598+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:54:12.7682286Z\",\"eventRecordID\":\"10521\",\"processID\":\"1592\",\"threadID\":\"19028\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:54:12.7682286Z","eventRecordID":"10521","processID":"1592","threadID":"19028","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.608+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:54:13.3236135Z\",\"eventRecordID\":\"10522\",\"processID\":\"1592\",\"threadID\":\"19028\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:54:13.3236135Z","eventRecordID":"10522","processID":"1592","threadID":"19028","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.608+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:54:15.4247584Z\",\"eventRecordID\":\"10523\",\"processID\":\"1592\",\"threadID\":\"14800\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:54:15.4247584Z","eventRecordID":"10523","processID":"1592","threadID":"14800","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.699+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:54:16.9311335Z\",\"eventRecordID\":\"10524\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T11:54:16.9311335Z","eventRecordID":"10524","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.733+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:53:35.3335917Z\",\"eventRecordID\":\"7237\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:53:35.3335917Z","eventRecordID":"7237","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.733+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T12:03:51.8523109Z\",\"eventRecordID\":\"10525\",\"processID\":\"1144\",\"threadID\":\"12764\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T12:03:51.8523109Z","eventRecordID":"10525","processID":"1144","threadID":"12764","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.806+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":1,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.127576","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T12:18:25.1535914Z\",\"eventRecordID\":\"10526\",\"processID\":\"1012\",\"threadID\":\"20128\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"uruchamianie na żądanie\",\"param3\":\"autostart\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T12:18:25.1535914Z","eventRecordID":"10526","processID":"1012","threadID":"20128","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"uruchamianie na żądanie","param3":"autostart","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.807+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":2,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.131852","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T12:21:22.1023699Z\",\"eventRecordID\":\"10527\",\"processID\":\"1012\",\"threadID\":\"15180\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"autostart\",\"param3\":\"uruchamianie na żądanie\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T12:21:22.1023699Z","eventRecordID":"10527","processID":"1012","threadID":"15180","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"autostart","param3":"uruchamianie na żądanie","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.811+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":3,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.133740","full_log":"{\"win\":{\"system\":{\"providerName\":\"NETLOGON\",\"eventID\":\"5719\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:09:09.9387593Z\",\"eventRecordID\":\"10528\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \\r\\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \\r\\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \\r\\n\\r\\nINFORMACJE DODATKOWE \\r\\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\\\"\"},\"eventdata\":{\"binary\":\"5E0000C0\",\"data\":\"DOMAIN, %%1311\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"NETLOGON","eventID":"5719","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:09:09.9387593Z","eventRecordID":"10528","processID":"0","threadID":"0","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \r\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \r\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \r\n\r\nINFORMACJE DODATKOWE \r\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\""},"eventdata":{"binary":"5E0000C0","data":"DOMAIN, %%1311"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.853+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.133740","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:54:05.9876534Z\",\"eventRecordID\":\"7238\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:54:05.9876534Z","eventRecordID":"7238","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.853+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":4,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.133740","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:27:07.8675413Z\",\"eventRecordID\":\"10529\",\"processID\":\"18740\",\"threadID\":\"20164\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"140\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:27:07.8675413Z","eventRecordID":"10529","processID":"18740","threadID":"20164","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"140","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.858+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.136834","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1501\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:27:07.8679025Z\",\"eventRecordID\":\"10530\",\"processID\":\"18740\",\"threadID\":\"20164\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"140\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1501","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:27:07.8679025Z","eventRecordID":"10530","processID":"18740","threadID":"20164","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"140"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.924+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.136834","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1500\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:27:27.6171477Z\",\"eventRecordID\":\"10532\",\"processID\":\"18740\",\"threadID\":\"19512\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1500","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:27:27.6171477Z","eventRecordID":"10532","processID":"18740","threadID":"19512","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.924+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":5,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.136834","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:27:27.6170203Z\",\"eventRecordID\":\"10531\",\"processID\":\"18740\",\"threadID\":\"19512\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:27:27.6170203Z","eventRecordID":"10531","processID":"18740","threadID":"19512","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"0","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.957+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T13:55:35.6600393Z\",\"eventRecordID\":\"10534\",\"processID\":\"4\",\"threadID\":\"13924\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T13:55:35.6600393Z","eventRecordID":"10534","processID":"4","threadID":"13924","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.957+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T13:55:35.1334768Z\",\"eventRecordID\":\"10533\",\"processID\":\"4\",\"threadID\":\"13924\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"293\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T13:55:35.1334768Z","eventRecordID":"10533","processID":"4","threadID":"13924","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"293"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:01.962+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315161.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T13:56:02.5003262Z\",\"eventRecordID\":\"10535\",\"processID\":\"4\",\"threadID\":\"13924\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T13:55:35.659994900Z na ‎2022‎-‎12‎-‎02T13:56:02.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T13:56:02.5000000Z\",\"oldTime\":\"2022-12-02T13:55:35.6599949Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T13:56:02.5003262Z","eventRecordID":"10535","processID":"4","threadID":"13924","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T13:55:35.659994900Z na ‎2022‎-‎12‎-‎02T13:56:02.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T13:56:02.5000000Z","oldTime":"2022-12-02T13:55:35.6599949Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.023+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:54:06.0097646Z\",\"eventRecordID\":\"7239\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:54:06.0097646Z","eventRecordID":"7239","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.023+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T13:56:02.6546163Z\",\"eventRecordID\":\"10536\",\"processID\":\"4\",\"threadID\":\"13924\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 147, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"147\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T13:56:02.6546163Z","eventRecordID":"10536","processID":"4","threadID":"13924","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 147, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"147","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.030+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T13:56:03.0888460Z\",\"eventRecordID\":\"10537\",\"processID\":\"1144\",\"threadID\":\"11740\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T13:56:03.0888460Z","eventRecordID":"10537","processID":"1144","threadID":"11740","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.041+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:56:04.8847783Z\",\"eventRecordID\":\"10538\",\"processID\":\"3908\",\"threadID\":\"18288\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T13:55:31.899204500Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T13:56:03.118479500Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T13:55:31.8992045Z\",\"wakeTime\":\"2022-12-02T13:56:03.1184795Z\",\"sleepDuration\":\"3489\",\"wakeDuration\":\"625\",\"driverInitDuration\":\"236\",\"biosInitDuration\":\"482\",\"hiberWriteDuration\":\"7017\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"276063\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"54\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:56:04.8847783Z","eventRecordID":"10538","processID":"3908","threadID":"18288","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T13:55:31.899204500Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T13:56:03.118479500Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T13:55:31.8992045Z","wakeTime":"2022-12-02T13:56:03.1184795Z","sleepDuration":"3489","wakeDuration":"625","driverInitDuration":"236","biosInitDuration":"482","hiberWriteDuration":"7017","hiberReadDuration":"0","hiberPagesWritten":"276063","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"54"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.047+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T13:56:08.0358891Z\",\"eventRecordID\":\"10539\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T13:56:08.0358891Z","eventRecordID":"10539","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.058+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:56:09.7578770Z\",\"eventRecordID\":\"10540\",\"processID\":\"1592\",\"threadID\":\"15684\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:56:09.7578770Z","eventRecordID":"10540","processID":"1592","threadID":"15684","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.059+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:56:10.2081229Z\",\"eventRecordID\":\"10541\",\"processID\":\"1592\",\"threadID\":\"15684\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:56:10.2081229Z","eventRecordID":"10541","processID":"1592","threadID":"15684","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.160+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:54:13.3132412Z\",\"eventRecordID\":\"7240\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:54:13.3132412Z","eventRecordID":"7240","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.161+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:56:12.4073823Z\",\"eventRecordID\":\"10542\",\"processID\":\"1592\",\"threadID\":\"14328\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:56:12.4073823Z","eventRecordID":"10542","processID":"1592","threadID":"14328","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.165+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:56:13.9176625Z\",\"eventRecordID\":\"10543\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T13:56:13.9176625Z","eventRecordID":"10543","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.198+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T14:05:48.8861790Z\",\"eventRecordID\":\"10544\",\"processID\":\"1144\",\"threadID\":\"18664\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T14:05:48.8861790Z","eventRecordID":"10544","processID":"1144","threadID":"18664","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.201+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T14:26:31.8539603Z\",\"eventRecordID\":\"10545\",\"processID\":\"4\",\"threadID\":\"14768\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"295\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T14:26:31.8539603Z","eventRecordID":"10545","processID":"4","threadID":"14768","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"295"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.260+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T14:26:32.3797007Z\",\"eventRecordID\":\"10546\",\"processID\":\"4\",\"threadID\":\"14768\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T14:26:32.3797007Z","eventRecordID":"10546","processID":"4","threadID":"14768","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.260+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T14:26:58.5003154Z\",\"eventRecordID\":\"10547\",\"processID\":\"4\",\"threadID\":\"14768\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T14:26:32.379636700Z na ‎2022‎-‎12‎-‎02T14:26:58.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T14:26:58.5000000Z\",\"oldTime\":\"2022-12-02T14:26:32.3796367Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T14:26:58.5003154Z","eventRecordID":"10547","processID":"4","threadID":"14768","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T14:26:32.379636700Z na ‎2022‎-‎12‎-‎02T14:26:58.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T14:26:58.5000000Z","oldTime":"2022-12-02T14:26:32.3796367Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.263+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T14:26:58.6622713Z\",\"eventRecordID\":\"10548\",\"processID\":\"4\",\"threadID\":\"14768\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 148, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"148\",\"fullResume\":\"439\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T14:26:58.6622713Z","eventRecordID":"10548","processID":"4","threadID":"14768","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 148, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"148","fullResume":"439","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.327+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T11:54:14.7609600Z\",\"eventRecordID\":\"7241\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T11:54:14.7609600Z","eventRecordID":"7241","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.330+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T14:26:59.0958642Z\",\"eventRecordID\":\"10549\",\"processID\":\"1144\",\"threadID\":\"13304\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T14:26:59.0958642Z","eventRecordID":"10549","processID":"1144","threadID":"13304","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.361+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T12:07:48.0085533Z\",\"eventRecordID\":\"7242\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T12:07:48.0085533Z","eventRecordID":"7242","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.362+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.139222","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:27:00.9004957Z\",\"eventRecordID\":\"10550\",\"processID\":\"3908\",\"threadID\":\"268\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T14:26:28.727814200Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T14:26:59.118507300Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T14:26:28.7278142Z\",\"wakeTime\":\"2022-12-02T14:26:59.1185073Z\",\"sleepDuration\":\"3379\",\"wakeDuration\":\"625\",\"driverInitDuration\":\"234\",\"biosInitDuration\":\"480\",\"hiberWriteDuration\":\"6949\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"273910\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"54\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:27:00.9004957Z","eventRecordID":"10550","processID":"3908","threadID":"268","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T14:26:28.727814200Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T14:26:59.118507300Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T14:26:28.7278142Z","wakeTime":"2022-12-02T14:26:59.1185073Z","sleepDuration":"3379","wakeDuration":"625","driverInitDuration":"234","biosInitDuration":"480","hiberWriteDuration":"6949","hiberReadDuration":"0","hiberPagesWritten":"273910","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"54"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.368+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":1,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T12:08:18.9461248Z\",\"eventRecordID\":\"7243\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T12:08:18Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-08T12:08:18Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T12:08:18.9461248Z","eventRecordID":"7243","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T12:08:18Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-08T12:08:18Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.409+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T14:27:05.1435434Z\",\"eventRecordID\":\"10551\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T14:27:05.1435434Z","eventRecordID":"10551","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.436+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:27:05.7682407Z\",\"eventRecordID\":\"10552\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:27:05.7682407Z","eventRecordID":"10552","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.447+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:27:06.2526448Z\",\"eventRecordID\":\"10553\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:27:06.2526448Z","eventRecordID":"10553","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.448+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:27:08.4166287Z\",\"eventRecordID\":\"10554\",\"processID\":\"1592\",\"threadID\":\"8412\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:27:08.4166287Z","eventRecordID":"10554","processID":"1592","threadID":"8412","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.490+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:27:09.9328445Z\",\"eventRecordID\":\"10555\",\"processID\":\"1592\",\"threadID\":\"11960\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:27:09.9328445Z","eventRecordID":"10555","processID":"1592","threadID":"11960","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.490+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:09:00.0079438Z\",\"eventRecordID\":\"7244\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:09:00.0079438Z","eventRecordID":"7244","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.498+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T14:36:44.7591018Z\",\"eventRecordID\":\"10556\",\"processID\":\"1144\",\"threadID\":\"18892\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T14:36:44.7591018Z","eventRecordID":"10556","processID":"1144","threadID":"18892","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.532+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T14:58:57.9618322Z\",\"eventRecordID\":\"10557\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"297\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T14:58:57.9618322Z","eventRecordID":"10557","processID":"4","threadID":"18772","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"297"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.542+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T14:59:27.5003111Z\",\"eventRecordID\":\"10559\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T14:58:58.488107500Z na ‎2022‎-‎12‎-‎02T14:59:27.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T14:59:27.5000000Z\",\"oldTime\":\"2022-12-02T14:58:58.4881075Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T14:59:27.5003111Z","eventRecordID":"10559","processID":"4","threadID":"18772","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T14:58:58.488107500Z na ‎2022‎-‎12‎-‎02T14:59:27.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T14:59:27.5000000Z","oldTime":"2022-12-02T14:58:58.4881075Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.542+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T14:58:58.4881596Z\",\"eventRecordID\":\"10558\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T14:58:58.4881596Z","eventRecordID":"10558","processID":"4","threadID":"18772","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.626+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T14:59:27.6594970Z\",\"eventRecordID\":\"10560\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 149, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"149\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T14:59:27.6594970Z","eventRecordID":"10560","processID":"4","threadID":"18772","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 149, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"149","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.633+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T14:59:28.0965736Z\",\"eventRecordID\":\"10561\",\"processID\":\"1144\",\"threadID\":\"19792\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T14:59:28.0965736Z","eventRecordID":"10561","processID":"1144","threadID":"19792","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.640+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:09:10.8055974Z\",\"eventRecordID\":\"7245\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:09:10.8055974Z","eventRecordID":"7245","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.641+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:59:29.8971576Z\",\"eventRecordID\":\"10562\",\"processID\":\"3908\",\"threadID\":\"17252\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T14:58:54.852846800Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T14:59:28.122211300Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T14:58:54.8528468Z\",\"wakeTime\":\"2022-12-02T14:59:28.1222113Z\",\"sleepDuration\":\"3362\",\"wakeDuration\":\"625\",\"driverInitDuration\":\"234\",\"biosInitDuration\":\"482\",\"hiberWriteDuration\":\"7129\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"276802\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"54\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:59:29.8971576Z","eventRecordID":"10562","processID":"3908","threadID":"17252","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T14:58:54.852846800Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T14:59:28.122211300Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T14:58:54.8528468Z","wakeTime":"2022-12-02T14:59:28.1222113Z","sleepDuration":"3362","wakeDuration":"625","driverInitDuration":"234","biosInitDuration":"482","hiberWriteDuration":"7129","hiberReadDuration":"0","hiberPagesWritten":"276802","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"54"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.694+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T14:59:33.6794306Z\",\"eventRecordID\":\"10563\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T14:59:33.6794306Z","eventRecordID":"10563","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.699+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:59:34.7694036Z\",\"eventRecordID\":\"10564\",\"processID\":\"1592\",\"threadID\":\"17616\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:59:34.7694036Z","eventRecordID":"10564","processID":"1592","threadID":"17616","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.730+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:59:35.2378038Z\",\"eventRecordID\":\"10565\",\"processID\":\"1592\",\"threadID\":\"17616\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:59:35.2378038Z","eventRecordID":"10565","processID":"1592","threadID":"17616","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.731+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:59:37.4098909Z\",\"eventRecordID\":\"10566\",\"processID\":\"1592\",\"threadID\":\"16096\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:59:37.4098909Z","eventRecordID":"10566","processID":"1592","threadID":"16096","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.773+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.141606","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T14:59:38.9183349Z\",\"eventRecordID\":\"10567\",\"processID\":\"1592\",\"threadID\":\"17260\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T14:59:38.9183349Z","eventRecordID":"10567","processID":"1592","threadID":"17260","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.776+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":6,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.143189","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:08:08.1078090Z\",\"eventRecordID\":\"10568\",\"processID\":\"10384\",\"threadID\":\"17616\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"156\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:08:08.1078090Z","eventRecordID":"10568","processID":"10384","threadID":"17616","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"156","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.848+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.143189","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1501\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:08:08.1081677Z\",\"eventRecordID\":\"10569\",\"processID\":\"10384\",\"threadID\":\"17616\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"156\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1501","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:08:08.1081677Z","eventRecordID":"10569","processID":"10384","threadID":"17616","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"156"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.847+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.143189","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:15:59.8597130Z\",\"eventRecordID\":\"7246\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:15:59.8597130Z","eventRecordID":"7246","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.854+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.143189","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T15:09:13.7941568Z\",\"eventRecordID\":\"10570\",\"processID\":\"1144\",\"threadID\":\"16624\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T15:09:13.7941568Z","eventRecordID":"10570","processID":"1144","threadID":"16624","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.880+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":3,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.145577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T15:11:03.1535365Z\",\"eventRecordID\":\"10571\",\"processID\":\"1012\",\"threadID\":\"17212\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"uruchamianie na żądanie\",\"param3\":\"autostart\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T15:11:03.1535365Z","eventRecordID":"10571","processID":"1012","threadID":"17212","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"uruchamianie na żądanie","param3":"autostart","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.886+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":4,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.147465","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T15:13:03.8409818Z\",\"eventRecordID\":\"10572\",\"processID\":\"1012\",\"threadID\":\"17212\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"autostart\",\"param3\":\"uruchamianie na żądanie\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T15:13:03.8409818Z","eventRecordID":"10572","processID":"1012","threadID":"17212","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"autostart","param3":"uruchamianie na żądanie","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.923+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":7,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:25:28.0961789Z\",\"eventRecordID\":\"10573\",\"processID\":\"11704\",\"threadID\":\"13112\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:25:28.0961789Z","eventRecordID":"10573","processID":"11704","threadID":"13112","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"0","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:02.924+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315162.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1500\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:25:28.0963368Z\",\"eventRecordID\":\"10574\",\"processID\":\"11704\",\"threadID\":\"13112\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1500","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:25:28.0963368Z","eventRecordID":"10574","processID":"11704","threadID":"13112","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.008+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:16:10.1759759Z\",\"eventRecordID\":\"7247\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:16:10.1759759Z","eventRecordID":"7247","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.008+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T15:44:57.1053206Z\",\"eventRecordID\":\"10575\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"299\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T15:44:57.1053206Z","eventRecordID":"10575","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"299"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.014+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6419\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:06.8570982Z\",\"eventRecordID\":\"10310919\",\"processID\":\"3184\",\"threadID\":\"12924\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Zażądano wyłączenia urządzenia. \\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tROOT\\\\NET\\\\0001\\r\\n\\r\\nNazwa urządzenia:\\tFortinet SSL VPN Virtual Ethernet Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e972-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tNet\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\troot\\\\ftsvnic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"ROOT\\\\\\\\NET\\\\\\\\0001\",\"deviceDescription\":\"Fortinet SSL VPN Virtual Ethernet Adapter\",\"classId\":\"{4d36e972-e325-11ce-bfc1-08002be10318}\",\"className\":\"Net\",\"hardwareIds\":\"    root\\\\\\\\ftsvnic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6419","version":"0","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:06.8570982Z","eventRecordID":"10310919","processID":"3184","threadID":"12924","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Zażądano wyłączenia urządzenia. \r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tROOT\\NET\\0001\r\n\r\nNazwa urządzenia:\tFortinet SSL VPN Virtual Ethernet Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e972-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tNet\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\troot\\ftsvnic\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"ROOT\\\\NET\\\\0001","deviceDescription":"Fortinet SSL VPN Virtual Ethernet Adapter","classId":"{4d36e972-e325-11ce-bfc1-08002be10318}","className":"Net","hardwareIds":"    root\\\\ftsvnic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.026+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T15:44:57.5984289Z\",\"eventRecordID\":\"10576\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T15:44:57.5984289Z","eventRecordID":"10576","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.026+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6420\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:06.8650670Z\",\"eventRecordID\":\"10310920\",\"processID\":\"4\",\"threadID\":\"16480\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Urządzenie zostało wyłączone. \\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tROOT\\\\NET\\\\0001\\r\\n\\r\\nNazwa urządzenia:\\tFortinet SSL VPN Virtual Ethernet Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e972-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tNet\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\troot\\\\ftsvnic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"ROOT\\\\\\\\NET\\\\\\\\0001\",\"deviceDescription\":\"Fortinet SSL VPN Virtual Ethernet Adapter\",\"classId\":\"{4d36e972-e325-11ce-bfc1-08002be10318}\",\"className\":\"Net\",\"hardwareIds\":\"    root\\\\\\\\ftsvnic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6420","version":"0","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:06.8650670Z","eventRecordID":"10310920","processID":"4","threadID":"16480","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Urządzenie zostało wyłączone. \r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tROOT\\NET\\0001\r\n\r\nNazwa urządzenia:\tFortinet SSL VPN Virtual Ethernet Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e972-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tNet\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\troot\\ftsvnic\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"ROOT\\\\NET\\\\0001","deviceDescription":"Fortinet SSL VPN Virtual Ethernet Adapter","classId":"{4d36e972-e325-11ce-bfc1-08002be10318}","className":"Net","hardwareIds":"    root\\\\ftsvnic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.036+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T15:45:25.6552712Z\",\"eventRecordID\":\"10578\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): PC15, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"PC15\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T15:45:25.6552712Z","eventRecordID":"10578","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): PC15, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"PC15","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.036+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.149353","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T15:45:25.5002998Z\",\"eventRecordID\":\"10577\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T15:44:57.598379600Z na ‎2022‎-‎12‎-‎02T15:45:25.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T15:45:25.5000000Z\",\"oldTime\":\"2022-12-02T15:44:57.5983796Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T15:45:25.5002998Z","eventRecordID":"10577","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T15:44:57.598379600Z na ‎2022‎-‎12‎-‎02T15:45:25.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T15:45:25.5000000Z","oldTime":"2022-12-02T15:44:57.5983796Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.111+0000","rule":{"level":5,"description":"System time changed.","id":"60132","firedtimes":1,"mail":false,"groups":["windows","windows_security","time_changed"],"gdpr":["IV_35.7.d"],"gpg13":["1.3","4.13"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"pci_dss":["10.6.1"],"tsc":["CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.151737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4616\",\"version\":\"1\",\"level\":\"0\",\"task\":\"12288\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:12.2583890Z\",\"eventRecordID\":\"10310921\",\"processID\":\"4\",\"threadID\":\"12756\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Czas systemowy został zmieniony.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\nInformacje dotyczące procesu:\\r\\n\\tIdentyfikator procesu:\\t0x638\\r\\n\\tNazwa:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nPoprzedni czas:\\t\\t‎2022‎-‎12‎-‎02T11:21:12.256054400Z\\r\\nNowy czas:\\t\\t‎2022‎-‎12‎-‎02T11:21:12.258098500Z\\r\\n\\r\\nTo zdarzenie jest generowane w momencie zmiany czasu systemowego. Regularne zmiany czasu systemowego wykonywane przez usługę Czas systemu Windows, która działa z uprawnieniami systemowymi, są normalne. Inne zmiany czasu systemowego mogą wskazywać próby naruszenia integralności komputera.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"previousTime\":\"2022-12-02T11:21:12.2560544Z\",\"newTime\":\"2022-12-02T11:21:12.2580985Z\",\"processId\":\"0x638\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4616","version":"1","level":"0","task":"12288","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:12.2583890Z","eventRecordID":"10310921","processID":"4","threadID":"12756","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Czas systemowy został zmieniony.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\nInformacje dotyczące procesu:\r\n\tIdentyfikator procesu:\t0x638\r\n\tNazwa:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nPoprzedni czas:\t\t‎2022‎-‎12‎-‎02T11:21:12.256054400Z\r\nNowy czas:\t\t‎2022‎-‎12‎-‎02T11:21:12.258098500Z\r\n\r\nTo zdarzenie jest generowane w momencie zmiany czasu systemowego. Regularne zmiany czasu systemowego wykonywane przez usługę Czas systemu Windows, która działa z uprawnieniami systemowymi, są normalne. Inne zmiany czasu systemowego mogą wskazywać próby naruszenia integralności komputera.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","previousTime":"2022-12-02T11:21:12.2560544Z","newTime":"2022-12-02T11:21:12.2580985Z","processId":"0x638","processName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.117+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.151737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T15:45:26.0425848Z\",\"eventRecordID\":\"10579\",\"processID\":\"1144\",\"threadID\":\"17648\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T15:45:26.0425848Z","eventRecordID":"10579","processID":"1144","threadID":"17648","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.166+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.151737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:45:27.8857610Z\",\"eventRecordID\":\"10580\",\"processID\":\"3908\",\"threadID\":\"268\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T15:44:53.870038100Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T15:45:26.106276000Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T15:44:53.8700381Z\",\"wakeTime\":\"2022-12-02T15:45:26.1062760Z\",\"sleepDuration\":\"3462\",\"wakeDuration\":\"605\",\"driverInitDuration\":\"231\",\"biosInitDuration\":\"481\",\"hiberWriteDuration\":\"6997\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"274505\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"41\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:45:27.8857610Z","eventRecordID":"10580","processID":"3908","threadID":"268","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T15:44:53.870038100Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T15:45:26.106276000Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T15:44:53.8700381Z","wakeTime":"2022-12-02T15:45:26.1062760Z","sleepDuration":"3462","wakeDuration":"605","driverInitDuration":"231","biosInitDuration":"481","hiberWriteDuration":"6997","hiberReadDuration":"0","hiberPagesWritten":"274505","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"41"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.167+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.151737","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:16:28.1565594Z\",\"eventRecordID\":\"7248\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:16:28.1565594Z","eventRecordID":"7248","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.195+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":1,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:42.9253173Z\",\"eventRecordID\":\"10310922\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:42.9253173Z","eventRecordID":"10310922","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.237+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T15:45:32.1887643Z\",\"eventRecordID\":\"10581\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T15:45:32.1887643Z","eventRecordID":"10581","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.242+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:45:32.8474594Z\",\"eventRecordID\":\"10582\",\"processID\":\"1592\",\"threadID\":\"8532\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:45:32.8474594Z","eventRecordID":"10582","processID":"1592","threadID":"8532","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.285+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:42.9253424Z\",\"eventRecordID\":\"10310923\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:42.9253424Z","eventRecordID":"10310923","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.289+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:45:36.4840599Z\",\"eventRecordID\":\"10583\",\"processID\":\"1592\",\"threadID\":\"8532\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:45:36.4840599Z","eventRecordID":"10583","processID":"1592","threadID":"8532","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.331+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:45:36.8222936Z\",\"eventRecordID\":\"10584\",\"processID\":\"1592\",\"threadID\":\"8532\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:45:36.8222936Z","eventRecordID":"10584","processID":"1592","threadID":"8532","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.332+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:45:38.3282444Z\",\"eventRecordID\":\"10585\",\"processID\":\"1592\",\"threadID\":\"4696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T15:45:38.3282444Z","eventRecordID":"10585","processID":"1592","threadID":"4696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.347+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.155176","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:45.1320489Z\",\"eventRecordID\":\"10310924\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:45.1320489Z","eventRecordID":"10310924","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.379+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.163286","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T15:55:11.8740782Z\",\"eventRecordID\":\"10586\",\"processID\":\"1144\",\"threadID\":\"20076\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T15:55:11.8740782Z","eventRecordID":"10586","processID":"1144","threadID":"20076","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.381+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.163286","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T16:15:54.9213664Z\",\"eventRecordID\":\"10587\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"301\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T16:15:54.9213664Z","eventRecordID":"10587","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"301"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.416+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.163286","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:45.1320638Z\",\"eventRecordID\":\"10310925\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:45.1320638Z","eventRecordID":"10310925","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.418+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.163286","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:16:38.0868756Z\",\"eventRecordID\":\"7249\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:16:38.0868756Z","eventRecordID":"7249","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.433+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.163286","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T16:15:55.4599510Z\",\"eventRecordID\":\"10588\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T16:15:55.4599510Z","eventRecordID":"10588","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.434+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.163286","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T16:16:22.5002990Z\",\"eventRecordID\":\"10589\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T16:15:55.459682800Z na ‎2022‎-‎12‎-‎02T16:16:22.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T16:16:22.5000000Z\",\"oldTime\":\"2022-12-02T16:15:55.4596828Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T16:16:22.5002990Z","eventRecordID":"10589","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T16:15:55.459682800Z na ‎2022‎-‎12‎-‎02T16:16:22.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T16:16:22.5000000Z","oldTime":"2022-12-02T16:15:55.4596828Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.449+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":3,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.163286","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:45.5161943Z\",\"eventRecordID\":\"10310926\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:45.5161943Z","eventRecordID":"10310926","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.453+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.171396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T16:16:22.6566369Z\",\"eventRecordID\":\"10590\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 151, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"151\",\"fullResume\":\"439\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T16:16:22.6566369Z","eventRecordID":"10590","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 151, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"151","fullResume":"439","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.462+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.171396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T16:16:23.1079539Z\",\"eventRecordID\":\"10591\",\"processID\":\"1144\",\"threadID\":\"14360\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T16:16:23.1079539Z","eventRecordID":"10591","processID":"1144","threadID":"14360","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.474+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.171396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:45.5162214Z\",\"eventRecordID\":\"10310927\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:45.5162214Z","eventRecordID":"10310927","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.480+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.171396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:16:24.9336821Z\",\"eventRecordID\":\"10592\",\"processID\":\"3908\",\"threadID\":\"12984\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T16:15:51.764712400Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T16:16:23.123458900Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T16:15:51.7647124Z\",\"wakeTime\":\"2022-12-02T16:16:23.1234589Z\",\"sleepDuration\":\"3420\",\"wakeDuration\":\"633\",\"driverInitDuration\":\"256\",\"biosInitDuration\":\"480\",\"hiberWriteDuration\":\"7146\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"277364\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"56\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:16:24.9336821Z","eventRecordID":"10592","processID":"3908","threadID":"12984","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T16:15:51.764712400Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T16:16:23.123458900Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T16:15:51.7647124Z","wakeTime":"2022-12-02T16:16:23.1234589Z","sleepDuration":"3420","wakeDuration":"633","driverInitDuration":"256","biosInitDuration":"480","hiberWriteDuration":"7146","hiberReadDuration":"0","hiberPagesWritten":"277364","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"56"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.491+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.171396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:16:29.7833626Z\",\"eventRecordID\":\"10593\",\"processID\":\"1592\",\"threadID\":\"16444\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:16:29.7833626Z","eventRecordID":"10593","processID":"1592","threadID":"16444","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.502+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":4,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.171396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:49.7252417Z\",\"eventRecordID\":\"10310928\",\"processID\":\"416\",\"threadID\":\"11496\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:49.7252417Z","eventRecordID":"10310928","processID":"416","threadID":"11496","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.508+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.179506","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:55:34.5087385Z\",\"eventRecordID\":\"7250\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:55:34.5087385Z","eventRecordID":"7250","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.514+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.179506","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:16:30.3150310Z\",\"eventRecordID\":\"10594\",\"processID\":\"1592\",\"threadID\":\"16444\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:16:30.3150310Z","eventRecordID":"10594","processID":"1592","threadID":"16444","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.544+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.179506","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T16:16:31.5163747Z\",\"eventRecordID\":\"10595\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T16:16:31.5163747Z","eventRecordID":"10595","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.555+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.179506","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:21:49.7252652Z\",\"eventRecordID\":\"10310929\",\"processID\":\"416\",\"threadID\":\"11496\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:21:49.7252652Z","eventRecordID":"10310929","processID":"416","threadID":"11496","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.567+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.179506","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:16:33.0534155Z\",\"eventRecordID\":\"10596\",\"processID\":\"1592\",\"threadID\":\"19780\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:16:33.0534155Z","eventRecordID":"10596","processID":"1592","threadID":"19780","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.573+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.179506","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T16:26:08.7482541Z\",\"eventRecordID\":\"10597\",\"processID\":\"1144\",\"threadID\":\"16148\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T16:26:08.7482541Z","eventRecordID":"10597","processID":"1144","threadID":"16148","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.583+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.179506","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T16:46:51.8896707Z\",\"eventRecordID\":\"10598\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"303\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T16:46:51.8896707Z","eventRecordID":"10598","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"303"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.588+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":1,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.187616","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:01.4563161Z\",\"eventRecordID\":\"10310930\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xE98604D\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xe98604d\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:01.4563161Z","eventRecordID":"10310930","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xE98604D\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xe98604d","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.599+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.187616","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T16:47:20.5005401Z\",\"eventRecordID\":\"10600\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T16:46:52.410021900Z na ‎2022‎-‎12‎-‎02T16:47:20.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T16:47:20.5000000Z\",\"oldTime\":\"2022-12-02T16:46:52.4100219Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T16:47:20.5005401Z","eventRecordID":"10600","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T16:46:52.410021900Z na ‎2022‎-‎12‎-‎02T16:47:20.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T16:47:20.5000000Z","oldTime":"2022-12-02T16:46:52.4100219Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.599+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.187616","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T16:46:52.4100673Z\",\"eventRecordID\":\"10599\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T16:46:52.4100673Z","eventRecordID":"10599","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.623+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.187616","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:01.4563373Z\",\"eventRecordID\":\"10310931\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xE98604D\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xe98604d\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:01.4563373Z","eventRecordID":"10310931","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xE98604D\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xe98604d","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.631+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.187616","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:56:02.9933092Z\",\"eventRecordID\":\"7251\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:56:02.9933092Z","eventRecordID":"7251","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.631+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.187616","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T16:47:20.6533332Z\",\"eventRecordID\":\"10601\",\"processID\":\"4\",\"threadID\":\"19484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 152, pełne wznowienie (FullResume): 438, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"152\",\"fullResume\":\"438\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T16:47:20.6533332Z","eventRecordID":"10601","processID":"4","threadID":"19484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 152, pełne wznowienie (FullResume): 438, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"152","fullResume":"438","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.634+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.187616","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T16:47:21.0945984Z\",\"eventRecordID\":\"10602\",\"processID\":\"1144\",\"threadID\":\"19476\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T16:47:21.0945984Z","eventRecordID":"10602","processID":"1144","threadID":"19476","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.645+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":1,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.195805","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:01.7997076Z\",\"eventRecordID\":\"10310932\",\"processID\":\"4\",\"threadID\":\"19336\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:01.7997076Z","eventRecordID":"10310932","processID":"4","threadID":"19336","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.645+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.195805","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:47:22.8783955Z\",\"eventRecordID\":\"10603\",\"processID\":\"3908\",\"threadID\":\"12932\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T16:46:48.810710900Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T16:47:21.110227700Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T16:46:48.8107109Z\",\"wakeTime\":\"2022-12-02T16:47:21.1102277Z\",\"sleepDuration\":\"3325\",\"wakeDuration\":\"621\",\"driverInitDuration\":\"235\",\"biosInitDuration\":\"480\",\"hiberWriteDuration\":\"6972\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"274922\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"56\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:47:22.8783955Z","eventRecordID":"10603","processID":"3908","threadID":"12932","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T16:46:48.810710900Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T16:47:21.110227700Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T16:46:48.8107109Z","wakeTime":"2022-12-02T16:47:21.1102277Z","sleepDuration":"3325","wakeDuration":"621","driverInitDuration":"235","biosInitDuration":"480","hiberWriteDuration":"6972","hiberReadDuration":"0","hiberPagesWritten":"274922","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"56"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.675+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.195805","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:47:27.7471249Z\",\"eventRecordID\":\"10604\",\"processID\":\"1592\",\"threadID\":\"15696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:47:27.7471249Z","eventRecordID":"10604","processID":"1592","threadID":"15696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.694+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":5,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.199233","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:01.8120093Z\",\"eventRecordID\":\"10310933\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:01.8120093Z","eventRecordID":"10310933","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.704+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.199233","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:47:28.2026872Z\",\"eventRecordID\":\"10605\",\"processID\":\"1592\",\"threadID\":\"15696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:47:28.2026872Z","eventRecordID":"10605","processID":"1592","threadID":"15696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.704+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.199233","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T16:47:28.6483874Z\",\"eventRecordID\":\"10606\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T16:47:28.6483874Z","eventRecordID":"10606","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.715+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.199233","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:01.8120243Z\",\"eventRecordID\":\"10310934\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:01.8120243Z","eventRecordID":"10310934","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.723+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.199233","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:56:03.0108351Z\",\"eventRecordID\":\"7252\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:56:03.0108351Z","eventRecordID":"7252","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.723+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.199233","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:47:30.4452341Z\",\"eventRecordID\":\"10607\",\"processID\":\"1592\",\"threadID\":\"15696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:47:30.4452341Z","eventRecordID":"10607","processID":"1592","threadID":"15696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.742+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.199233","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:47:31.9539896Z\",\"eventRecordID\":\"10608\",\"processID\":\"1592\",\"threadID\":\"15696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:47:31.9539896Z","eventRecordID":"10608","processID":"1592","threadID":"15696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.744+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":2,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.207341","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:01.8138940Z\",\"eventRecordID\":\"10310935\",\"processID\":\"4\",\"threadID\":\"19792\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:01.8138940Z","eventRecordID":"10310935","processID":"4","threadID":"19792","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.754+0000","rule":{"level":10,"description":"Multiple System error events","id":"61110","frequency":8,"firedtimes":1,"mail":false,"groups":["windows","windows_system"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.210565","previous_output":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:25:28.0961789Z\",\"eventRecordID\":\"10573\",\"processID\":\"11704\",\"threadID\":\"13112\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T15:08:08.1078090Z\",\"eventRecordID\":\"10568\",\"processID\":\"10384\",\"threadID\":\"17616\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"156\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:27:27.6170203Z\",\"eventRecordID\":\"10531\",\"processID\":\"18740\",\"threadID\":\"19512\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T13:27:07.8675413Z\",\"eventRecordID\":\"10529\",\"processID\":\"18740\",\"threadID\":\"20164\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"140\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"NETLOGON\",\"eventID\":\"5719\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:09:09.9387593Z\",\"eventRecordID\":\"10528\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \\r\\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \\r\\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \\r\\n\\r\\nINFORMACJE DODATKOWE \\r\\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\\\"\"},\"eventdata\":{\"binary\":\"5E0000C0\",\"data\":\"DOMAIN, %%1311\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:46:07.4736460Z\",\"eventRecordID\":\"10512\",\"processID\":\"17512\",\"threadID\":\"19584\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"141\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T11:29:27.2102738Z\",\"eventRecordID\":\"10509\",\"processID\":\"20472\",\"threadID\":\"11440\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"16\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:49:07.4206894Z\",\"eventRecordID\":\"10609\",\"processID\":\"20208\",\"threadID\":\"18416\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"188\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:49:07.4206894Z","eventRecordID":"10609","processID":"20208","threadID":"18416","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"188","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.772+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.210565","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T16:57:06.7507221Z\",\"eventRecordID\":\"10611\",\"processID\":\"1144\",\"threadID\":\"16144\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T16:57:06.7507221Z","eventRecordID":"10611","processID":"1144","threadID":"16144","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.772+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.210565","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1501\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T16:49:07.4210495Z\",\"eventRecordID\":\"10610\",\"processID\":\"20208\",\"threadID\":\"18416\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"188\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1501","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T16:49:07.4210495Z","eventRecordID":"10610","processID":"20208","threadID":"18416","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"188"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.793+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.210565","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T17:17:50.1044889Z\",\"eventRecordID\":\"10612\",\"processID\":\"4\",\"threadID\":\"18880\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"305\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T17:17:50.1044889Z","eventRecordID":"10612","processID":"4","threadID":"18880","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"305"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.793+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":6,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.220409","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:06.3187254Z\",\"eventRecordID\":\"10310936\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:06.3187254Z","eventRecordID":"10310936","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.803+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.220409","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:06.3187408Z\",\"eventRecordID\":\"10310937\",\"processID\":\"416\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:06.3187408Z","eventRecordID":"10310937","processID":"416","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.809+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.220409","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:56:10.3638479Z\",\"eventRecordID\":\"7253\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:56:10.3638479Z","eventRecordID":"7253","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.809+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.220409","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T17:17:50.6306195Z\",\"eventRecordID\":\"10613\",\"processID\":\"4\",\"threadID\":\"18880\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T17:17:50.6306195Z","eventRecordID":"10613","processID":"4","threadID":"18880","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.819+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.220409","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T17:18:19.6550509Z\",\"eventRecordID\":\"10615\",\"processID\":\"4\",\"threadID\":\"18880\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 153, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"153\",\"fullResume\":\"439\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T17:18:19.6550509Z","eventRecordID":"10615","processID":"4","threadID":"18880","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 153, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"153","fullResume":"439","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.820+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.220409","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T17:18:19.5003213Z\",\"eventRecordID\":\"10614\",\"processID\":\"4\",\"threadID\":\"18880\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T17:17:50.630573000Z na ‎2022‎-‎12‎-‎02T17:18:19.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T17:18:19.5000000Z\",\"oldTime\":\"2022-12-02T17:17:50.6305730Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T17:18:19.5003213Z","eventRecordID":"10614","processID":"4","threadID":"18880","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T17:17:50.630573000Z na ‎2022‎-‎12‎-‎02T17:18:19.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T17:18:19.5000000Z","oldTime":"2022-12-02T17:17:50.6305730Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.843+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":7,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.220409","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:40.7563790Z\",\"eventRecordID\":\"10310938\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:40.7563790Z","eventRecordID":"10310938","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.848+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.228519","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T17:18:20.0911015Z\",\"eventRecordID\":\"10616\",\"processID\":\"1144\",\"threadID\":\"19292\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T17:18:20.0911015Z","eventRecordID":"10616","processID":"1144","threadID":"19292","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.861+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.228519","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:22:40.7564140Z\",\"eventRecordID\":\"10310939\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:22:40.7564140Z","eventRecordID":"10310939","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.871+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.228519","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T13:56:11.6551658Z\",\"eventRecordID\":\"7254\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T13:56:11.6551658Z","eventRecordID":"7254","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.871+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.228519","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:18:21.8801270Z\",\"eventRecordID\":\"10617\",\"processID\":\"3908\",\"threadID\":\"19824\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T17:17:46.891311900Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T17:18:20.113733200Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T17:17:46.8913119Z\",\"wakeTime\":\"2022-12-02T17:18:20.1137332Z\",\"sleepDuration\":\"3461\",\"wakeDuration\":\"617\",\"driverInitDuration\":\"236\",\"biosInitDuration\":\"481\",\"hiberWriteDuration\":\"7057\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"278456\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"84\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:18:21.8801270Z","eventRecordID":"10617","processID":"3908","threadID":"19824","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T17:17:46.891311900Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T17:18:20.113733200Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T17:17:46.8913119Z","wakeTime":"2022-12-02T17:18:20.1137332Z","sleepDuration":"3461","wakeDuration":"617","driverInitDuration":"236","biosInitDuration":"481","hiberWriteDuration":"7057","hiberReadDuration":"0","hiberPagesWritten":"278456","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"84"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.891+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":8,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.228519","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:23:38.0556907Z\",\"eventRecordID\":\"10310940\",\"processID\":\"416\",\"threadID\":\"19628\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:23:38.0556907Z","eventRecordID":"10310940","processID":"416","threadID":"19628","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.891+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":8,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.228519","full_log":"{\"win\":{\"system\":{\"providerName\":\"NETLOGON\",\"eventID\":\"5719\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:18:26.8790333Z\",\"eventRecordID\":\"10618\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \\r\\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \\r\\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \\r\\n\\r\\nINFORMACJE DODATKOWE \\r\\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\\\"\"},\"eventdata\":{\"binary\":\"5E0000C0\",\"data\":\"DOMAIN, %%1311\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"NETLOGON","eventID":"5719","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:18:26.8790333Z","eventRecordID":"10618","processID":"0","threadID":"0","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \r\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \r\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \r\n\r\nINFORMACJE DODATKOWE \r\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\""},"eventdata":{"binary":"5E0000C0","data":"DOMAIN, %%1311"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.902+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.244737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T17:18:26.0142332Z\",\"eventRecordID\":\"10619\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T17:18:26.0142332Z","eventRecordID":"10619","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.934+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.244737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:18:26.7346655Z\",\"eventRecordID\":\"10620\",\"processID\":\"1592\",\"threadID\":\"4696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:18:26.7346655Z","eventRecordID":"10620","processID":"1592","threadID":"4696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.933+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.244737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:23:38.0557135Z\",\"eventRecordID\":\"10310941\",\"processID\":\"416\",\"threadID\":\"19628\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:23:38.0557135Z","eventRecordID":"10310941","processID":"416","threadID":"19628","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.936+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.244737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:18:27.1827023Z\",\"eventRecordID\":\"10621\",\"processID\":\"1592\",\"threadID\":\"4696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:18:27.1827023Z","eventRecordID":"10621","processID":"1592","threadID":"4696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.952+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.244737","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:18:29.3982883Z\",\"eventRecordID\":\"10622\",\"processID\":\"1592\",\"threadID\":\"18288\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:18:29.3982883Z","eventRecordID":"10622","processID":"1592","threadID":"18288","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.962+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.244737","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:26:31.3371049Z\",\"eventRecordID\":\"7255\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:26:31.3371049Z","eventRecordID":"7255","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.976+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":9,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.247831","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:23:45.9907362Z\",\"eventRecordID\":\"10310942\",\"processID\":\"416\",\"threadID\":\"19628\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:23:45.9907362Z","eventRecordID":"10310942","processID":"416","threadID":"19628","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.976+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.247831","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:18:30.9089382Z\",\"eventRecordID\":\"10623\",\"processID\":\"1592\",\"threadID\":\"19284\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:18:30.9089382Z","eventRecordID":"10623","processID":"1592","threadID":"19284","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:03.983+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":9,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315163.255941","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:23:27.5804591Z\",\"eventRecordID\":\"10624\",\"processID\":\"8088\",\"threadID\":\"5192\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:23:27.5804591Z","eventRecordID":"10624","processID":"8088","threadID":"5192","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"0","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.007+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.255941","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1500\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:23:27.5806168Z\",\"eventRecordID\":\"10625\",\"processID\":\"8088\",\"threadID\":\"5192\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1500","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:23:27.5806168Z","eventRecordID":"10625","processID":"8088","threadID":"5192","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.007+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.255941","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:23:45.9907537Z\",\"eventRecordID\":\"10310943\",\"processID\":\"416\",\"threadID\":\"19628\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:23:45.9907537Z","eventRecordID":"10310943","processID":"416","threadID":"19628","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.032+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.255941","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T17:48:48.8589856Z\",\"eventRecordID\":\"10627\",\"processID\":\"4\",\"threadID\":\"11668\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"307\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T17:48:48.8589856Z","eventRecordID":"10627","processID":"4","threadID":"11668","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"307"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.032+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.255941","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T17:28:05.7543852Z\",\"eventRecordID\":\"10626\",\"processID\":\"1144\",\"threadID\":\"17904\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T17:28:05.7543852Z","eventRecordID":"10626","processID":"1144","threadID":"17904","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.046+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":10,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.258321","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:24:51.2414942Z\",\"eventRecordID\":\"10310944\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:24:51.2414942Z","eventRecordID":"10310944","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.051+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.258321","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T17:48:49.3808646Z\",\"eventRecordID\":\"10628\",\"processID\":\"4\",\"threadID\":\"11668\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T17:48:49.3808646Z","eventRecordID":"10628","processID":"4","threadID":"11668","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.055+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.258321","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:26:58.9623233Z\",\"eventRecordID\":\"7256\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:26:58.9623233Z","eventRecordID":"7256","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.079+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.258321","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:24:51.2415295Z\",\"eventRecordID\":\"10310945\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:24:51.2415295Z","eventRecordID":"10310945","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.083+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.258321","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T17:49:18.5002963Z\",\"eventRecordID\":\"10629\",\"processID\":\"4\",\"threadID\":\"11668\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T17:48:49.380796700Z na ‎2022‎-‎12‎-‎02T17:49:18.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T17:49:18.5000000Z\",\"oldTime\":\"2022-12-02T17:48:49.3807967Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T17:49:18.5002963Z","eventRecordID":"10629","processID":"4","threadID":"11668","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T17:48:49.380796700Z na ‎2022‎-‎12‎-‎02T17:49:18.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T17:49:18.5000000Z","oldTime":"2022-12-02T17:48:49.3807967Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.090+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.258321","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T17:49:18.6540809Z\",\"eventRecordID\":\"10630\",\"processID\":\"4\",\"threadID\":\"11668\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 154, pełne wznowienie (FullResume): 437, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"154\",\"fullResume\":\"437\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T17:49:18.6540809Z","eventRecordID":"10630","processID":"4","threadID":"11668","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 154, pełne wznowienie (FullResume): 437, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"154","fullResume":"437","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.118+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.258321","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T17:49:19.0898660Z\",\"eventRecordID\":\"10631\",\"processID\":\"1144\",\"threadID\":\"20476\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T17:49:19.0898660Z","eventRecordID":"10631","processID":"1144","threadID":"20476","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.129+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":11,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.266429","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:25:56.5384074Z\",\"eventRecordID\":\"10310946\",\"processID\":\"416\",\"threadID\":\"12764\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:25:56.5384074Z","eventRecordID":"10310946","processID":"416","threadID":"12764","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.140+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.266429","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:49:20.8819179Z\",\"eventRecordID\":\"10632\",\"processID\":\"3908\",\"threadID\":\"12932\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T17:48:45.754045200Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T17:49:19.115499800Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T17:48:45.7540452Z\",\"wakeTime\":\"2022-12-02T17:49:19.1154998Z\",\"sleepDuration\":\"3357\",\"wakeDuration\":\"617\",\"driverInitDuration\":\"234\",\"biosInitDuration\":\"478\",\"hiberWriteDuration\":\"7225\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"275292\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"39\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:49:20.8819179Z","eventRecordID":"10632","processID":"3908","threadID":"12932","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T17:48:45.754045200Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T17:49:19.115499800Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T17:48:45.7540452Z","wakeTime":"2022-12-02T17:49:19.1154998Z","sleepDuration":"3357","wakeDuration":"617","driverInitDuration":"234","biosInitDuration":"478","hiberWriteDuration":"7225","hiberReadDuration":"0","hiberPagesWritten":"275292","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"39"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.147+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.266429","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:25:56.5384457Z\",\"eventRecordID\":\"10310947\",\"processID\":\"416\",\"threadID\":\"12764\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:25:56.5384457Z","eventRecordID":"10310947","processID":"416","threadID":"12764","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.158+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.266429","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T17:49:24.6819746Z\",\"eventRecordID\":\"10633\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T17:49:24.6819746Z","eventRecordID":"10633","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.165+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.266429","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:49:25.7359531Z\",\"eventRecordID\":\"10634\",\"processID\":\"1592\",\"threadID\":\"19284\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:49:25.7359531Z","eventRecordID":"10634","processID":"1592","threadID":"19284","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.167+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.266429","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:26:59.0056112Z\",\"eventRecordID\":\"7257\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:26:59.0056112Z","eventRecordID":"7257","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.173+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.266429","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:49:26.2012067Z\",\"eventRecordID\":\"10635\",\"processID\":\"1592\",\"threadID\":\"19284\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:49:26.2012067Z","eventRecordID":"10635","processID":"1592","threadID":"19284","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.193+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":12,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.274539","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:26:06.3019782Z\",\"eventRecordID\":\"10310948\",\"processID\":\"416\",\"threadID\":\"12764\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:26:06.3019782Z","eventRecordID":"10310948","processID":"416","threadID":"12764","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.203+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.274539","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:49:28.4080673Z\",\"eventRecordID\":\"10636\",\"processID\":\"1592\",\"threadID\":\"19452\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:49:28.4080673Z","eventRecordID":"10636","processID":"1592","threadID":"19452","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.226+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.274539","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:49:29.9267524Z\",\"eventRecordID\":\"10637\",\"processID\":\"1592\",\"threadID\":\"256\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T17:49:29.9267524Z","eventRecordID":"10637","processID":"1592","threadID":"256","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.230+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.274539","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:26:06.3019948Z\",\"eventRecordID\":\"10310949\",\"processID\":\"416\",\"threadID\":\"12764\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:26:06.3019948Z","eventRecordID":"10310949","processID":"416","threadID":"12764","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.241+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.274539","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T17:59:04.7884666Z\",\"eventRecordID\":\"10638\",\"processID\":\"1144\",\"threadID\":\"6068\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T17:59:04.7884666Z","eventRecordID":"10638","processID":"1144","threadID":"6068","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.276+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.274539","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T18:19:48.0322783Z\",\"eventRecordID\":\"10639\",\"processID\":\"4\",\"threadID\":\"16264\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"309\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T18:19:48.0322783Z","eventRecordID":"10639","processID":"4","threadID":"16264","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"309"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.276+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.274539","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T18:19:48.5752682Z\",\"eventRecordID\":\"10640\",\"processID\":\"4\",\"threadID\":\"16264\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T18:19:48.5752682Z","eventRecordID":"10640","processID":"4","threadID":"16264","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.293+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":13,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.282649","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:27:32.9184347Z\",\"eventRecordID\":\"10310950\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:27:32.9184347Z","eventRecordID":"10310950","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.304+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.282649","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:27:06.4259825Z\",\"eventRecordID\":\"7258\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:27:06.4259825Z","eventRecordID":"7258","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.309+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.282649","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T18:20:16.5002910Z\",\"eventRecordID\":\"10641\",\"processID\":\"4\",\"threadID\":\"16264\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T18:19:48.575208700Z na ‎2022‎-‎12‎-‎02T18:20:16.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T18:20:16.5000000Z\",\"oldTime\":\"2022-12-02T18:19:48.5752087Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T18:20:16.5002910Z","eventRecordID":"10641","processID":"4","threadID":"16264","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T18:19:48.575208700Z na ‎2022‎-‎12‎-‎02T18:20:16.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T18:20:16.5000000Z","oldTime":"2022-12-02T18:19:48.5752087Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.319+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.282649","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:27:32.9184693Z\",\"eventRecordID\":\"10310951\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:27:32.9184693Z","eventRecordID":"10310951","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.325+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.282649","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T18:20:16.6573782Z\",\"eventRecordID\":\"10642\",\"processID\":\"4\",\"threadID\":\"16264\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 155, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"155\",\"fullResume\":\"439\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T18:20:16.6573782Z","eventRecordID":"10642","processID":"4","threadID":"16264","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 155, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"155","fullResume":"439","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.330+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.282649","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T18:20:17.0225203Z\",\"eventRecordID\":\"10643\",\"processID\":\"1144\",\"threadID\":\"19500\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T18:20:17.0225203Z","eventRecordID":"10643","processID":"1144","threadID":"19500","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.344+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":14,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.290757","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:27:55.0534462Z\",\"eventRecordID\":\"10310952\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:27:55.0534462Z","eventRecordID":"10310952","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.352+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.290757","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:20:18.8876488Z\",\"eventRecordID\":\"10644\",\"processID\":\"3908\",\"threadID\":\"17884\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T18:19:44.881039200Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T18:20:17.090562900Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T18:19:44.8810392Z\",\"wakeTime\":\"2022-12-02T18:20:17.0905629Z\",\"sleepDuration\":\"3401\",\"wakeDuration\":\"602\",\"driverInitDuration\":\"232\",\"biosInitDuration\":\"481\",\"hiberWriteDuration\":\"8111\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"275500\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"46\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:20:18.8876488Z","eventRecordID":"10644","processID":"3908","threadID":"17884","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T18:19:44.881039200Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T18:20:17.090562900Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T18:19:44.8810392Z","wakeTime":"2022-12-02T18:20:17.0905629Z","sleepDuration":"3401","wakeDuration":"602","driverInitDuration":"232","biosInitDuration":"481","hiberWriteDuration":"8111","hiberReadDuration":"0","hiberPagesWritten":"275500","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"46"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.363+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.290757","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:27:55.0534625Z\",\"eventRecordID\":\"10310953\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:27:55.0534625Z","eventRecordID":"10310953","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.385+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.290757","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T18:20:22.6681714Z\",\"eventRecordID\":\"10645\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T18:20:22.6681714Z","eventRecordID":"10645","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.393+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.290757","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T18:20:23.4405895Z\",\"eventRecordID\":\"10646\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T18:20:23.4405895Z","eventRecordID":"10646","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.403+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.290757","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:27:07.6981173Z\",\"eventRecordID\":\"7259\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:27:07.6981173Z","eventRecordID":"7259","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.404+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.290757","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:20:23.7692440Z\",\"eventRecordID\":\"10647\",\"processID\":\"1592\",\"threadID\":\"8260\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:20:23.7692440Z","eventRecordID":"10647","processID":"1592","threadID":"8260","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.432+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":15,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.298865","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:30:13.3188849Z\",\"eventRecordID\":\"10310954\",\"processID\":\"416\",\"threadID\":\"16204\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:30:13.3188849Z","eventRecordID":"10310954","processID":"416","threadID":"16204","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.437+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.298865","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:20:24.0940685Z\",\"eventRecordID\":\"10648\",\"processID\":\"1592\",\"threadID\":\"8260\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:20:24.0940685Z","eventRecordID":"10648","processID":"1592","threadID":"8260","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.442+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.298865","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:20:26.8695901Z\",\"eventRecordID\":\"10649\",\"processID\":\"1592\",\"threadID\":\"14024\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:20:26.8695901Z","eventRecordID":"10649","processID":"1592","threadID":"14024","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.454+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.298865","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:30:13.3189007Z\",\"eventRecordID\":\"10310955\",\"processID\":\"416\",\"threadID\":\"16204\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:30:13.3189007Z","eventRecordID":"10310955","processID":"416","threadID":"16204","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.458+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.298865","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:20:28.3828767Z\",\"eventRecordID\":\"10650\",\"processID\":\"1592\",\"threadID\":\"3808\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:20:28.3828767Z","eventRecordID":"10650","processID":"1592","threadID":"3808","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.473+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.298865","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T18:30:02.7934761Z\",\"eventRecordID\":\"10651\",\"processID\":\"1144\",\"threadID\":\"11316\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T18:30:02.7934761Z","eventRecordID":"10651","processID":"1144","threadID":"11316","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.478+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":10,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.306975","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:30:07.7878235Z\",\"eventRecordID\":\"10652\",\"processID\":\"19876\",\"threadID\":\"2228\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"140\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:30:07.7878235Z","eventRecordID":"10652","processID":"19876","threadID":"2228","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"140","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.493+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":16,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.309361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:32:04.6981951Z\",\"eventRecordID\":\"10310956\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:32:04.6981951Z","eventRecordID":"10310956","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.511+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.309361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1501\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:30:07.7881858Z\",\"eventRecordID\":\"10653\",\"processID\":\"19876\",\"threadID\":\"2228\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"140\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1501","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:30:07.7881858Z","eventRecordID":"10653","processID":"19876","threadID":"2228","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"140"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.511+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.309361","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:58:57.4622877Z\",\"eventRecordID\":\"7260\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:58:57.4622877Z","eventRecordID":"7260","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.513+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.309361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T18:50:45.9203402Z\",\"eventRecordID\":\"10654\",\"processID\":\"4\",\"threadID\":\"20240\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"311\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T18:50:45.9203402Z","eventRecordID":"10654","processID":"4","threadID":"20240","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"311"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.527+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.309361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:32:04.6982294Z\",\"eventRecordID\":\"10310957\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:32:04.6982294Z","eventRecordID":"10310957","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.531+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.309361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T18:50:46.4570882Z\",\"eventRecordID\":\"10655\",\"processID\":\"4\",\"threadID\":\"20240\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T18:50:46.4570882Z","eventRecordID":"10655","processID":"4","threadID":"20240","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.537+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.309361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T18:51:13.5005509Z\",\"eventRecordID\":\"10656\",\"processID\":\"4\",\"threadID\":\"20240\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T18:50:46.456603300Z na ‎2022‎-‎12‎-‎02T18:51:13.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T18:51:13.5000000Z\",\"oldTime\":\"2022-12-02T18:50:46.4566033Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T18:51:13.5005509Z","eventRecordID":"10656","processID":"4","threadID":"20240","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T18:50:46.456603300Z na ‎2022‎-‎12‎-‎02T18:51:13.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T18:51:13.5000000Z","oldTime":"2022-12-02T18:50:46.4566033Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.552+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":17,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:33:31.6160821Z\",\"eventRecordID\":\"10310958\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:33:31.6160821Z","eventRecordID":"10310958","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.558+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T18:51:13.6513182Z\",\"eventRecordID\":\"10657\",\"processID\":\"4\",\"threadID\":\"20240\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 156, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"156\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T18:51:13.6513182Z","eventRecordID":"10657","processID":"4","threadID":"20240","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 156, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"156","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.571+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T18:51:14.1024480Z\",\"eventRecordID\":\"10658\",\"processID\":\"1144\",\"threadID\":\"12736\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T18:51:14.1024480Z","eventRecordID":"10658","processID":"1144","threadID":"12736","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.578+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:33:31.6160998Z\",\"eventRecordID\":\"10310959\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:33:31.6160998Z","eventRecordID":"10310959","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.590+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:59:27.9662791Z\",\"eventRecordID\":\"7261\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:59:27.9662791Z","eventRecordID":"7261","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.590+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:51:15.8843217Z\",\"eventRecordID\":\"10659\",\"processID\":\"3908\",\"threadID\":\"19660\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T18:50:42.803484800Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T18:51:14.102448000Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T18:50:42.8034848Z\",\"wakeTime\":\"2022-12-02T18:51:14.1024480Z\",\"sleepDuration\":\"3371\",\"wakeDuration\":\"614\",\"driverInitDuration\":\"230\",\"biosInitDuration\":\"482\",\"hiberWriteDuration\":\"7221\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"275774\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"39\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:51:15.8843217Z","eventRecordID":"10659","processID":"3908","threadID":"19660","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T18:50:42.803484800Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T18:51:14.102448000Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T18:50:42.8034848Z","wakeTime":"2022-12-02T18:51:14.1024480Z","sleepDuration":"3371","wakeDuration":"614","driverInitDuration":"230","biosInitDuration":"482","hiberWriteDuration":"7221","hiberReadDuration":"0","hiberPagesWritten":"275774","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"39"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.603+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:51:20.7786598Z\",\"eventRecordID\":\"10660\",\"processID\":\"1592\",\"threadID\":\"256\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:51:20.7786598Z","eventRecordID":"10660","processID":"1592","threadID":"256","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.612+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":18,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.317469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:38:29.7782683Z\",\"eventRecordID\":\"10310960\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:38:29.7782683Z","eventRecordID":"10310960","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.622+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.325577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T18:51:22.4759707Z\",\"eventRecordID\":\"10661\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T18:51:22.4759707Z","eventRecordID":"10661","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.627+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.325577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:51:22.6683873Z\",\"eventRecordID\":\"10662\",\"processID\":\"1592\",\"threadID\":\"256\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:51:22.6683873Z","eventRecordID":"10662","processID":"1592","threadID":"256","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.639+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.325577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:38:29.7783047Z\",\"eventRecordID\":\"10310961\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:38:29.7783047Z","eventRecordID":"10310961","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.661+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.325577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:51:23.8706839Z\",\"eventRecordID\":\"10663\",\"processID\":\"1592\",\"threadID\":\"256\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T18:51:23.8706839Z","eventRecordID":"10663","processID":"1592","threadID":"256","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.669+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.325577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T19:00:59.7111172Z\",\"eventRecordID\":\"10664\",\"processID\":\"1144\",\"threadID\":\"20280\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T19:00:59.7111172Z","eventRecordID":"10664","processID":"1144","threadID":"20280","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.680+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.325577","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:59:28.0159139Z\",\"eventRecordID\":\"7262\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:59:28.0159139Z","eventRecordID":"7262","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.687+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":11,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.325577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:21:27.6063560Z\",\"eventRecordID\":\"10665\",\"processID\":\"8308\",\"threadID\":\"16912\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:21:27.6063560Z","eventRecordID":"10665","processID":"8308","threadID":"16912","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"0","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.701+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":19,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.336067","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:38:49.8190682Z\",\"eventRecordID\":\"10310962\",\"processID\":\"416\",\"threadID\":\"10712\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:38:49.8190682Z","eventRecordID":"10310962","processID":"416","threadID":"10712","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.708+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.336067","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1500\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:21:27.6065206Z\",\"eventRecordID\":\"10666\",\"processID\":\"8308\",\"threadID\":\"16912\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1500","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:21:27.6065206Z","eventRecordID":"10666","processID":"8308","threadID":"16912","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.713+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.336067","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T19:23:12.9963029Z\",\"eventRecordID\":\"10667\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"313\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T19:23:12.9963029Z","eventRecordID":"10667","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"313"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.724+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.336067","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:38:49.8191111Z\",\"eventRecordID\":\"10310963\",\"processID\":\"416\",\"threadID\":\"10712\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:38:49.8191111Z","eventRecordID":"10310963","processID":"416","threadID":"10712","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.738+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.336067","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T19:23:13.5357312Z\",\"eventRecordID\":\"10668\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T19:23:13.5357312Z","eventRecordID":"10668","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.738+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.336067","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T19:23:41.5003048Z\",\"eventRecordID\":\"10669\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T19:23:13.535681500Z na ‎2022‎-‎12‎-‎02T19:23:41.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T19:23:41.5000000Z\",\"oldTime\":\"2022-12-02T19:23:13.5356815Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T19:23:41.5003048Z","eventRecordID":"10669","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T19:23:13.535681500Z na ‎2022‎-‎12‎-‎02T19:23:41.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T19:23:41.5000000Z","oldTime":"2022-12-02T19:23:13.5356815Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.753+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":20,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:48:08.0848315Z\",\"eventRecordID\":\"10310964\",\"processID\":\"416\",\"threadID\":\"13524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:48:08.0848315Z","eventRecordID":"10310964","processID":"416","threadID":"13524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.759+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T19:23:41.6790943Z\",\"eventRecordID\":\"10670\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 157, pełne wznowienie (FullResume): 438, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"157\",\"fullResume\":\"438\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T19:23:41.6790943Z","eventRecordID":"10670","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 157, pełne wznowienie (FullResume): 438, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"157","fullResume":"438","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.762+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:59:35.3641902Z\",\"eventRecordID\":\"7263\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:59:35.3641902Z","eventRecordID":"7263","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.787+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T19:23:42.1002530Z\",\"eventRecordID\":\"10671\",\"processID\":\"1144\",\"threadID\":\"4464\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T19:23:42.1002530Z","eventRecordID":"10671","processID":"1144","threadID":"4464","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.795+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:48:08.0848543Z\",\"eventRecordID\":\"10310965\",\"processID\":\"416\",\"threadID\":\"13524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:48:08.0848543Z","eventRecordID":"10310965","processID":"416","threadID":"13524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.803+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:23:43.9281689Z\",\"eventRecordID\":\"10672\",\"processID\":\"3908\",\"threadID\":\"14404\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T19:23:09.851731900Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T19:23:42.117292700Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T19:23:09.8517319Z\",\"wakeTime\":\"2022-12-02T19:23:42.1172927Z\",\"sleepDuration\":\"3408\",\"wakeDuration\":\"630\",\"driverInitDuration\":\"231\",\"biosInitDuration\":\"480\",\"hiberWriteDuration\":\"7155\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"275549\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"47\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:23:43.9281689Z","eventRecordID":"10672","processID":"3908","threadID":"14404","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T19:23:09.851731900Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T19:23:42.117292700Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T19:23:09.8517319Z","wakeTime":"2022-12-02T19:23:42.1172927Z","sleepDuration":"3408","wakeDuration":"630","driverInitDuration":"231","biosInitDuration":"480","hiberWriteDuration":"7155","hiberReadDuration":"0","hiberPagesWritten":"275549","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"47"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.809+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:23:48.7442867Z\",\"eventRecordID\":\"10673\",\"processID\":\"1592\",\"threadID\":\"20132\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:23:48.7442867Z","eventRecordID":"10673","processID":"1592","threadID":"20132","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.825+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":21,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.344177","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:48:11.0901759Z\",\"eventRecordID\":\"10310966\",\"processID\":\"416\",\"threadID\":\"13524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:48:11.0901759Z","eventRecordID":"10310966","processID":"416","threadID":"13524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.834+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.352287","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:23:49.2066211Z\",\"eventRecordID\":\"10674\",\"processID\":\"1592\",\"threadID\":\"20132\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:23:49.2066211Z","eventRecordID":"10674","processID":"1592","threadID":"20132","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.845+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.352287","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T19:23:50.4921873Z\",\"eventRecordID\":\"10675\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T19:23:50.4921873Z","eventRecordID":"10675","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.862+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.352287","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:48:11.0902080Z\",\"eventRecordID\":\"10310967\",\"processID\":\"416\",\"threadID\":\"13524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:48:11.0902080Z","eventRecordID":"10310967","processID":"416","threadID":"13524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.895+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.352287","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T14:59:36.6223662Z\",\"eventRecordID\":\"7264\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T14:59:36.6223662Z","eventRecordID":"7264","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.910+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.352287","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:23:51.9138981Z\",\"eventRecordID\":\"10676\",\"processID\":\"1592\",\"threadID\":\"16112\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:23:51.9138981Z","eventRecordID":"10676","processID":"1592","threadID":"16112","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.910+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.352287","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:23:53.4309056Z\",\"eventRecordID\":\"10677\",\"processID\":\"1592\",\"threadID\":\"19056\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:23:53.4309056Z","eventRecordID":"10677","processID":"1592","threadID":"19056","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.929+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.352287","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T19:33:27.7266886Z\",\"eventRecordID\":\"10678\",\"processID\":\"1144\",\"threadID\":\"1900\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T19:33:27.7266886Z","eventRecordID":"10678","processID":"1144","threadID":"1900","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.948+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":22,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.360397","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:54.8510146Z\",\"eventRecordID\":\"10310968\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:54.8510146Z","eventRecordID":"10310968","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.956+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.360397","full_log":"{\"win\":{\"system\":{\"providerName\":\"edgeupdate\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:03:09.0597013Z\",\"eventRecordID\":\"7265\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Service stopped.\\\"\"},\"eventdata\":{\"data\":\"Service stopped\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"edgeupdate","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:03:09.0597013Z","eventRecordID":"7265","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Service stopped.\""},"eventdata":{"data":"Service stopped"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:04.977+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315164.360397","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T19:54:10.9960298Z\",\"eventRecordID\":\"10679\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"315\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T19:54:10.9960298Z","eventRecordID":"10679","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"315"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.000+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.360397","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:09:41.1222035Z\",\"eventRecordID\":\"7266\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:09:41.1222035Z","eventRecordID":"7266","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.003+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.360397","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:54.8510533Z\",\"eventRecordID\":\"10310969\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:54.8510533Z","eventRecordID":"10310969","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.036+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.360397","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T19:54:11.5203208Z\",\"eventRecordID\":\"10680\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T19:54:11.5203208Z","eventRecordID":"10680","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.036+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":2,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.360397","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:10:20.4034851Z\",\"eventRecordID\":\"7267\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T15:10:20Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-08T15:10:20Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:10:20.4034851Z","eventRecordID":"7267","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T15:10:20Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-08T15:10:20Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.078+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.368505","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T19:54:39.5003298Z\",\"eventRecordID\":\"10681\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T19:54:11.520276200Z na ‎2022‎-‎12‎-‎02T19:54:39.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T19:54:39.5000000Z\",\"oldTime\":\"2022-12-02T19:54:11.5202762Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T19:54:39.5003298Z","eventRecordID":"10681","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T19:54:11.520276200Z na ‎2022‎-‎12‎-‎02T19:54:39.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T19:54:39.5000000Z","oldTime":"2022-12-02T19:54:11.5202762Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.090+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":23,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.368505","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:56.6829070Z\",\"eventRecordID\":\"10310970\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:56.6829070Z","eventRecordID":"10310970","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.108+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.370088","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T19:54:39.6573572Z\",\"eventRecordID\":\"10682\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 158, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"158\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T19:54:39.6573572Z","eventRecordID":"10682","processID":"4","threadID":"16224","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 158, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"158","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.112+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.370088","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T19:54:40.0935226Z\",\"eventRecordID\":\"10683\",\"processID\":\"1144\",\"threadID\":\"13772\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T19:54:40.0935226Z","eventRecordID":"10683","processID":"1144","threadID":"13772","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.140+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.370088","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:56.6829263Z\",\"eventRecordID\":\"10310971\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:56.6829263Z","eventRecordID":"10310971","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.147+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.370088","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:54:41.8966541Z\",\"eventRecordID\":\"10684\",\"processID\":\"3908\",\"threadID\":\"17884\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T19:54:07.820463700Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T19:54:40.109150300Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T19:54:07.8204637Z\",\"wakeTime\":\"2022-12-02T19:54:40.1091503Z\",\"sleepDuration\":\"3427\",\"wakeDuration\":\"609\",\"driverInitDuration\":\"231\",\"biosInitDuration\":\"481\",\"hiberWriteDuration\":\"7100\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"276432\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"46\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:54:41.8966541Z","eventRecordID":"10684","processID":"3908","threadID":"17884","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T19:54:07.820463700Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T19:54:40.109150300Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T19:54:07.8204637Z","wakeTime":"2022-12-02T19:54:40.1091503Z","sleepDuration":"3427","wakeDuration":"609","driverInitDuration":"231","biosInitDuration":"481","hiberWriteDuration":"7100","hiberReadDuration":"0","hiberPagesWritten":"276432","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"46"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.161+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":24,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.370088","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:58.8448308Z\",\"eventRecordID\":\"10310972\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:58.8448308Z","eventRecordID":"10310972","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.181+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.378198","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T19:54:46.0406615Z\",\"eventRecordID\":\"10685\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T19:54:46.0406615Z","eventRecordID":"10685","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.191+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.378198","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:54:46.7733227Z\",\"eventRecordID\":\"10686\",\"processID\":\"1592\",\"threadID\":\"17048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:54:46.7733227Z","eventRecordID":"10686","processID":"1592","threadID":"17048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.218+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.378198","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:58.8448502Z\",\"eventRecordID\":\"10310973\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:58.8448502Z","eventRecordID":"10310973","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.221+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.378198","full_log":"{\"win\":{\"system\":{\"providerName\":\"gupdate\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:11:38.6535925Z\",\"eventRecordID\":\"7268\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"Service stopped\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"gupdate","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:11:38.6535925Z","eventRecordID":"7268","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"Service stopped"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.251+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.378198","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:54:47.2679143Z\",\"eventRecordID\":\"10687\",\"processID\":\"1592\",\"threadID\":\"17048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:54:47.2679143Z","eventRecordID":"10687","processID":"1592","threadID":"17048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.252+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.378198","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:54:49.4477575Z\",\"eventRecordID\":\"10688\",\"processID\":\"1592\",\"threadID\":\"17048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:54:49.4477575Z","eventRecordID":"10688","processID":"1592","threadID":"17048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.281+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.378198","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:54:50.9536827Z\",\"eventRecordID\":\"10689\",\"processID\":\"1592\",\"threadID\":\"19056\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T19:54:50.9536827Z","eventRecordID":"10689","processID":"1592","threadID":"19056","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.291+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":25,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.386308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:58.9282678Z\",\"eventRecordID\":\"10310974\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:58.9282678Z","eventRecordID":"10310974","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.311+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.386308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T20:04:25.9014492Z\",\"eventRecordID\":\"10690\",\"processID\":\"1144\",\"threadID\":\"18760\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T20:04:25.9014492Z","eventRecordID":"10690","processID":"1144","threadID":"18760","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.317+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":12,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:11:07.9487591Z\",\"eventRecordID\":\"10691\",\"processID\":\"10180\",\"threadID\":\"15656\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"172\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:11:07.9487591Z","eventRecordID":"10691","processID":"10180","threadID":"15656","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"172","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.345+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:58.9282862Z\",\"eventRecordID\":\"10310975\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:58.9282862Z","eventRecordID":"10310975","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.348+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1501\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:11:07.9491389Z\",\"eventRecordID\":\"10692\",\"processID\":\"10180\",\"threadID\":\"15656\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"188\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1501","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:11:07.9491389Z","eventRecordID":"10692","processID":"10180","threadID":"15656","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"188"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.377+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T20:25:08.9063360Z\",\"eventRecordID\":\"10693\",\"processID\":\"4\",\"threadID\":\"984\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"317\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T20:25:08.9063360Z","eventRecordID":"10693","processID":"4","threadID":"984","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"317"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.378+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:44:56.4951789Z\",\"eventRecordID\":\"7269\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:44:56.4951789Z","eventRecordID":"7269","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.405+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:58.9971033Z\",\"eventRecordID\":\"10310976\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:58.9971033Z","eventRecordID":"10310976","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.407+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T20:25:09.4433479Z\",\"eventRecordID\":\"10694\",\"processID\":\"4\",\"threadID\":\"984\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T20:25:09.4433479Z","eventRecordID":"10694","processID":"4","threadID":"984","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.441+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T20:25:37.6761052Z\",\"eventRecordID\":\"10696\",\"processID\":\"4\",\"threadID\":\"984\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 159, pełne wznowienie (FullResume): 437, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"159\",\"fullResume\":\"437\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T20:25:37.6761052Z","eventRecordID":"10696","processID":"4","threadID":"984","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 159, pełne wznowienie (FullResume): 437, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"159","fullResume":"437","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.441+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T20:25:37.5002982Z\",\"eventRecordID\":\"10695\",\"processID\":\"4\",\"threadID\":\"984\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T20:25:09.443299200Z na ‎2022‎-‎12‎-‎02T20:25:37.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T20:25:37.5000000Z\",\"oldTime\":\"2022-12-02T20:25:09.4432992Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T20:25:37.5002982Z","eventRecordID":"10695","processID":"4","threadID":"984","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T20:25:09.443299200Z na ‎2022‎-‎12‎-‎02T20:25:37.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T20:25:37.5000000Z","oldTime":"2022-12-02T20:25:09.4432992Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.466+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:58.9973523Z\",\"eventRecordID\":\"10310977\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:58.9973523Z","eventRecordID":"10310977","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.472+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T20:25:38.1188652Z\",\"eventRecordID\":\"10697\",\"processID\":\"1144\",\"threadID\":\"17180\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T20:25:38.1188652Z","eventRecordID":"10697","processID":"1144","threadID":"17180","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.497+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:25:39.9173121Z\",\"eventRecordID\":\"10698\",\"processID\":\"3908\",\"threadID\":\"16748\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T20:25:05.792574100Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T20:25:38.165627000Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T20:25:05.7925741Z\",\"wakeTime\":\"2022-12-02T20:25:38.1656270Z\",\"sleepDuration\":\"3374\",\"wakeDuration\":\"674\",\"driverInitDuration\":\"232\",\"biosInitDuration\":\"478\",\"hiberWriteDuration\":\"7054\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"277492\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"42\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:25:39.9173121Z","eventRecordID":"10698","processID":"3908","threadID":"16748","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T20:25:05.792574100Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T20:25:38.165627000Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T20:25:05.7925741Z","wakeTime":"2022-12-02T20:25:38.1656270Z","sleepDuration":"3374","wakeDuration":"674","driverInitDuration":"232","biosInitDuration":"478","hiberWriteDuration":"7054","hiberReadDuration":"0","hiberPagesWritten":"277492","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"42"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.497+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:45:25.9886123Z\",\"eventRecordID\":\"7270\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:45:25.9886123Z","eventRecordID":"7270","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.538+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:58.9974262Z\",\"eventRecordID\":\"10310978\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:target=virtualapp/didlogical\",\"type\":\"0\",\"countOfCredentialsReturned\":\"1\",\"readOperation\":\"%%8100\",\"returnCode\":\"0\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:58.9974262Z","eventRecordID":"10310978","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:target=virtualapp/didlogical","type":"0","countOfCredentialsReturned":"1","readOperation":"%%8100","returnCode":"0","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.544+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T20:25:42.7616928Z\",\"eventRecordID\":\"10699\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T20:25:42.7616928Z","eventRecordID":"10699","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.561+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:25:44.7378831Z\",\"eventRecordID\":\"10700\",\"processID\":\"1592\",\"threadID\":\"10712\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:25:44.7378831Z","eventRecordID":"10700","processID":"1592","threadID":"10712","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.561+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:25:45.1793850Z\",\"eventRecordID\":\"10701\",\"processID\":\"1592\",\"threadID\":\"10712\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:25:45.1793850Z","eventRecordID":"10701","processID":"1592","threadID":"10712","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.574+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.0001036Z\",\"eventRecordID\":\"10310979\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.0001036Z","eventRecordID":"10310979","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.591+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:25:47.4084239Z\",\"eventRecordID\":\"10702\",\"processID\":\"1592\",\"threadID\":\"12900\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:25:47.4084239Z","eventRecordID":"10702","processID":"1592","threadID":"12900","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.605+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:25:48.9206324Z\",\"eventRecordID\":\"10703\",\"processID\":\"1592\",\"threadID\":\"19056\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:25:48.9206324Z","eventRecordID":"10703","processID":"1592","threadID":"19056","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.635+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T20:35:23.7123171Z\",\"eventRecordID\":\"10704\",\"processID\":\"1144\",\"threadID\":\"10656\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T20:35:23.7123171Z","eventRecordID":"10704","processID":"1144","threadID":"10656","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.639+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:45:26.0113310Z\",\"eventRecordID\":\"7271\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:45:26.0113310Z","eventRecordID":"7271","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.666+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T20:56:07.0329330Z\",\"eventRecordID\":\"10705\",\"processID\":\"4\",\"threadID\":\"13488\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"319\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T20:56:07.0329330Z","eventRecordID":"10705","processID":"4","threadID":"13488","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"319"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.668+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.0003761Z\",\"eventRecordID\":\"10310980\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.0003761Z","eventRecordID":"10310980","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.700+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T20:56:07.5508626Z\",\"eventRecordID\":\"10706\",\"processID\":\"4\",\"threadID\":\"13488\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T20:56:07.5508626Z","eventRecordID":"10706","processID":"4","threadID":"13488","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.700+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T20:56:34.5003017Z\",\"eventRecordID\":\"10707\",\"processID\":\"4\",\"threadID\":\"13488\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T20:56:07.550817900Z na ‎2022‎-‎12‎-‎02T20:56:34.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T20:56:34.5000000Z\",\"oldTime\":\"2022-12-02T20:56:07.5508179Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T20:56:34.5003017Z","eventRecordID":"10707","processID":"4","threadID":"13488","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T20:56:07.550817900Z na ‎2022‎-‎12‎-‎02T20:56:34.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T20:56:34.5000000Z","oldTime":"2022-12-02T20:56:07.5508179Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.728+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.0004567Z\",\"eventRecordID\":\"10310981\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:target=virtualapp/didlogical\",\"type\":\"0\",\"countOfCredentialsReturned\":\"1\",\"readOperation\":\"%%8100\",\"returnCode\":\"0\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.0004567Z","eventRecordID":"10310981","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:target=virtualapp/didlogical","type":"0","countOfCredentialsReturned":"1","readOperation":"%%8100","returnCode":"0","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.730+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T20:56:34.6588723Z\",\"eventRecordID\":\"10708\",\"processID\":\"4\",\"threadID\":\"13488\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 160, pełne wznowienie (FullResume): 441, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"160\",\"fullResume\":\"441\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T20:56:34.6588723Z","eventRecordID":"10708","processID":"4","threadID":"13488","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 160, pełne wznowienie (FullResume): 441, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"160","fullResume":"441","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.759+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T20:56:35.0921447Z\",\"eventRecordID\":\"10709\",\"processID\":\"1144\",\"threadID\":\"11876\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T20:56:35.0921447Z","eventRecordID":"10709","processID":"1144","threadID":"11876","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.761+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:45:33.4077686Z\",\"eventRecordID\":\"7272\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:45:33.4077686Z","eventRecordID":"7272","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.789+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.0025790Z\",\"eventRecordID\":\"10310982\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.0025790Z","eventRecordID":"10310982","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.793+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:56:36.8883948Z\",\"eventRecordID\":\"10710\",\"processID\":\"3908\",\"threadID\":\"8456\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T20:56:03.868480400Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T20:56:35.107772100Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T20:56:03.8684804Z\",\"wakeTime\":\"2022-12-02T20:56:35.1077721Z\",\"sleepDuration\":\"3413\",\"wakeDuration\":\"616\",\"driverInitDuration\":\"233\",\"biosInitDuration\":\"482\",\"hiberWriteDuration\":\"7057\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"277653\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"61\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:56:36.8883948Z","eventRecordID":"10710","processID":"3908","threadID":"8456","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T20:56:03.868480400Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T20:56:35.107772100Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T20:56:03.8684804Z","wakeTime":"2022-12-02T20:56:35.1077721Z","sleepDuration":"3413","wakeDuration":"616","driverInitDuration":"233","biosInitDuration":"482","hiberWriteDuration":"7057","hiberReadDuration":"0","hiberPagesWritten":"277653","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"61"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.820+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T20:56:41.5083571Z\",\"eventRecordID\":\"10711\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T20:56:41.5083571Z","eventRecordID":"10711","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.825+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:56:41.7708475Z\",\"eventRecordID\":\"10712\",\"processID\":\"1592\",\"threadID\":\"17704\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:56:41.7708475Z","eventRecordID":"10712","processID":"1592","threadID":"17704","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.851+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.0026583Z\",\"eventRecordID\":\"10310983\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.0026583Z","eventRecordID":"10310983","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.853+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:56:42.2321953Z\",\"eventRecordID\":\"10713\",\"processID\":\"1592\",\"threadID\":\"17704\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:56:42.2321953Z","eventRecordID":"10713","processID":"1592","threadID":"17704","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.882+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:56:44.9071944Z\",\"eventRecordID\":\"10714\",\"processID\":\"1592\",\"threadID\":\"256\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:56:44.9071944Z","eventRecordID":"10714","processID":"1592","threadID":"256","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.883+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:56:46.4199404Z\",\"eventRecordID\":\"10715\",\"processID\":\"1592\",\"threadID\":\"19056\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T20:56:46.4199404Z","eventRecordID":"10715","processID":"1592","threadID":"19056","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.913+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.0029635Z\",\"eventRecordID\":\"10310984\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.0029635Z","eventRecordID":"10310984","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.919+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T21:06:20.8407411Z\",\"eventRecordID\":\"10716\",\"processID\":\"1144\",\"threadID\":\"14988\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T21:06:20.8407411Z","eventRecordID":"10716","processID":"1144","threadID":"14988","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.948+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":13,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.394418","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:19:27.9556900Z\",\"eventRecordID\":\"10717\",\"processID\":\"19176\",\"threadID\":\"15628\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:19:27.9556900Z","eventRecordID":"10717","processID":"19176","threadID":"15628","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"0","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.948+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.396806","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:45:34.7179907Z\",\"eventRecordID\":\"7273\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:45:34.7179907Z","eventRecordID":"7273","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.981+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.396806","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:51:33.5303058Z\",\"eventRecordID\":\"7274\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:51:33.5303058Z","eventRecordID":"7274","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:05.981+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315165.396806","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1500\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:19:27.9558704Z\",\"eventRecordID\":\"10718\",\"processID\":\"19176\",\"threadID\":\"15628\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1500","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:19:27.9558704Z","eventRecordID":"10718","processID":"19176","threadID":"15628","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego komputera. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.007+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.396806","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.6282794Z\",\"eventRecordID\":\"10310985\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.6282794Z","eventRecordID":"10310985","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.009+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":3,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T15:52:08.2647061Z\",\"eventRecordID\":\"7275\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T15:52:08Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-08T15:52:08Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T15:52:08.2647061Z","eventRecordID":"7275","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T15:52:08Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-08T15:52:08Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.040+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T21:27:03.9708943Z\",\"eventRecordID\":\"10719\",\"processID\":\"4\",\"threadID\":\"7628\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"321\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T21:27:03.9708943Z","eventRecordID":"10719","processID":"4","threadID":"7628","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"321"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.040+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T21:27:04.5048728Z\",\"eventRecordID\":\"10720\",\"processID\":\"4\",\"threadID\":\"7628\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T21:27:04.5048728Z","eventRecordID":"10720","processID":"4","threadID":"7628","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.070+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.6356286Z\",\"eventRecordID\":\"10310986\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.6356286Z","eventRecordID":"10310986","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.072+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T21:27:33.5003280Z\",\"eventRecordID\":\"10721\",\"processID\":\"4\",\"threadID\":\"7628\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T21:27:04.504828800Z na ‎2022‎-‎12‎-‎02T21:27:33.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T21:27:33.5000000Z\",\"oldTime\":\"2022-12-02T21:27:04.5048288Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T21:27:33.5003280Z","eventRecordID":"10721","processID":"4","threadID":"7628","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T21:27:04.504828800Z na ‎2022‎-‎12‎-‎02T21:27:33.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T21:27:33.5000000Z","oldTime":"2022-12-02T21:27:04.5048288Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.102+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T21:27:33.6586817Z\",\"eventRecordID\":\"10722\",\"processID\":\"4\",\"threadID\":\"7628\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 161, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"161\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T21:27:33.6586817Z","eventRecordID":"10722","processID":"4","threadID":"7628","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 161, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"161","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.102+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:15:54.3740797Z\",\"eventRecordID\":\"7276\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:15:54.3740797Z","eventRecordID":"7276","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.133+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T21:27:34.0936666Z\",\"eventRecordID\":\"10723\",\"processID\":\"1144\",\"threadID\":\"13164\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T21:27:34.0936666Z","eventRecordID":"10723","processID":"1144","threadID":"13164","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.139+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.6397878Z\",\"eventRecordID\":\"10310987\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.6397878Z","eventRecordID":"10310987","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.164+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:27:35.8917990Z\",\"eventRecordID\":\"10724\",\"processID\":\"3908\",\"threadID\":\"14868\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T21:27:00.825121500Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T21:27:34.123299500Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T21:27:00.8251215Z\",\"wakeTime\":\"2022-12-02T21:27:34.1232995Z\",\"sleepDuration\":\"3400\",\"wakeDuration\":\"630\",\"driverInitDuration\":\"234\",\"biosInitDuration\":\"481\",\"hiberWriteDuration\":\"7269\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"276898\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"53\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:27:35.8917990Z","eventRecordID":"10724","processID":"3908","threadID":"14868","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T21:27:00.825121500Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T21:27:34.123299500Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T21:27:00.8251215Z","wakeTime":"2022-12-02T21:27:34.1232995Z","sleepDuration":"3400","wakeDuration":"630","driverInitDuration":"234","biosInitDuration":"481","hiberWriteDuration":"7269","hiberReadDuration":"0","hiberPagesWritten":"276898","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"53"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.167+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:27:40.7423527Z\",\"eventRecordID\":\"10725\",\"processID\":\"1592\",\"threadID\":\"19056\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:27:40.7423527Z","eventRecordID":"10725","processID":"1592","threadID":"19056","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.195+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:51:59.6398900Z\",\"eventRecordID\":\"10310988\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T11:51:58.9297298Z\",\"clientProcessId\":\"17816\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:51:59.6398900Z","eventRecordID":"10310988","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T11:51:58.9297298Z","clientProcessId":"17816"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.198+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:27:41.0799500Z\",\"eventRecordID\":\"10726\",\"processID\":\"1592\",\"threadID\":\"19056\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:27:41.0799500Z","eventRecordID":"10726","processID":"1592","threadID":"19056","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.228+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T21:27:42.4957957Z\",\"eventRecordID\":\"10727\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T21:27:42.4957957Z","eventRecordID":"10727","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.233+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:27:43.8215586Z\",\"eventRecordID\":\"10728\",\"processID\":\"1592\",\"threadID\":\"16940\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:27:43.8215586Z","eventRecordID":"10728","processID":"1592","threadID":"16940","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.251+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":26,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.399190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:09.6055861Z\",\"eventRecordID\":\"10310989\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:09.6055861Z","eventRecordID":"10310989","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.257+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.400773","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:16:22.9901373Z\",\"eventRecordID\":\"7277\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:16:22.9901373Z","eventRecordID":"7277","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.277+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.400773","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:27:45.3270996Z\",\"eventRecordID\":\"10729\",\"processID\":\"1592\",\"threadID\":\"16940\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:27:45.3270996Z","eventRecordID":"10729","processID":"1592","threadID":"16940","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.298+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.400773","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T21:37:19.7792697Z\",\"eventRecordID\":\"10730\",\"processID\":\"1144\",\"threadID\":\"20128\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T21:37:19.7792697Z","eventRecordID":"10730","processID":"1144","threadID":"20128","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.320+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.400773","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:09.6056092Z\",\"eventRecordID\":\"10310990\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:09.6056092Z","eventRecordID":"10310990","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.334+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":14,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.400773","full_log":"{\"win\":{\"system\":{\"providerName\":\"NETLOGON\",\"eventID\":\"5719\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:52:08.2947507Z\",\"eventRecordID\":\"10731\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \\r\\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \\r\\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \\r\\n\\r\\nINFORMACJE DODATKOWE \\r\\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\\\"\"},\"eventdata\":{\"binary\":\"5E0000C0\",\"data\":\"DOMAIN, %%1311\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"NETLOGON","eventID":"5719","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:52:08.2947507Z","eventRecordID":"10731","processID":"0","threadID":"0","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \r\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \r\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \r\n\r\nINFORMACJE DODATKOWE \r\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\""},"eventdata":{"binary":"5E0000C0","data":"DOMAIN, %%1311"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.352+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":27,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.411975","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:10.5105787Z\",\"eventRecordID\":\"10310991\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:10.5105787Z","eventRecordID":"10310991","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.365+0000","rule":{"level":10,"description":"Multiple System error events","id":"61110","frequency":8,"firedtimes":2,"mail":false,"groups":["windows","windows_system"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.420085","previous_output":"{\"win\":{\"system\":{\"providerName\":\"NETLOGON\",\"eventID\":\"5719\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:52:08.2947507Z\",\"eventRecordID\":\"10731\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \\r\\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \\r\\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \\r\\n\\r\\nINFORMACJE DODATKOWE \\r\\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\\\"\"},\"eventdata\":{\"binary\":\"5E0000C0\",\"data\":\"DOMAIN, %%1311\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:19:27.9556900Z\",\"eventRecordID\":\"10717\",\"processID\":\"19176\",\"threadID\":\"15628\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T20:11:07.9487591Z\",\"eventRecordID\":\"10691\",\"processID\":\"10180\",\"threadID\":\"15656\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"172\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T19:21:27.6063560Z\",\"eventRecordID\":\"10665\",\"processID\":\"8308\",\"threadID\":\"16912\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T18:30:07.7878235Z\",\"eventRecordID\":\"10652\",\"processID\":\"19876\",\"threadID\":\"2228\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"140\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T17:23:27.5804591Z\",\"eventRecordID\":\"10624\",\"processID\":\"8088\",\"threadID\":\"5192\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"0\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}\n{\"win\":{\"system\":{\"providerName\":\"NETLOGON\",\"eventID\":\"5719\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:18:26.8790333Z\",\"eventRecordID\":\"10618\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \\r\\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \\r\\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \\r\\n\\r\\nINFORMACJE DODATKOWE \\r\\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\\\"\"},\"eventdata\":{\"binary\":\"5E0000C0\",\"data\":\"DOMAIN, %%1311\"}}}","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1129\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:52:08.3131558Z\",\"eventRecordID\":\"10732\",\"processID\":\"17260\",\"threadID\":\"19948\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"2057\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"156\",\"errorCode\":\"1222\",\"errorDescription\":\"Brak sieci lub nie została ona uruchomiona.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1129","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:52:08.3131558Z","eventRecordID":"10732","processID":"17260","threadID":"19948","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Przetwarzanie zasad grupy nie powiodło się z powodu braku łączności sieciowej z kontrolerem domeny. To może być stan przejściowy. Po połączeniu komputera z kontrolerem domeny i pomyślnym przetworzeniu zasad grupy powinien zostać wygenerowany komunikat o powodzeniu. Jeśli komunikat o powodzeniu nie zostanie wyświetlony w ciągu kilku godzin, skontaktuj się z administratorem.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"2057","processingMode":"0","processingTimeInMilliseconds":"156","errorCode":"1222","errorDescription":"Brak sieci lub nie została ona uruchomiona."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.398+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.420085","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-GroupPolicy\",\"providerGuid\":\"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}\",\"eventID\":\"1501\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"1\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:52:08.3135169Z\",\"eventRecordID\":\"10733\",\"processID\":\"17260\",\"threadID\":\"19948\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\\\"\"},\"eventdata\":{\"supportInfo1\":\"1\",\"supportInfo2\":\"4292\",\"processingMode\":\"0\",\"processingTimeInMilliseconds\":\"156\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-GroupPolicy","providerGuid":"{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}","eventID":"1501","version":"0","level":"4","task":"0","opcode":"1","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:52:08.3135169Z","eventRecordID":"10733","processID":"17260","threadID":"19948","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Pomyślnie przetworzono ustawienia zasad grupy dla tego użytkownika. Nie wykryto żadnych zmian od czasu ostatniego pomyślnego przetworzenia zasad grupy.\""},"eventdata":{"supportInfo1":"1","supportInfo2":"4292","processingMode":"0","processingTimeInMilliseconds":"156"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.411+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.420085","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:10.5105935Z\",\"eventRecordID\":\"10310992\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:10.5105935Z","eventRecordID":"10310992","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.426+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.420085","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:16:23.0131372Z\",\"eventRecordID\":\"7278\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:16:23.0131372Z","eventRecordID":"7278","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.435+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.420085","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T21:58:02.8991491Z\",\"eventRecordID\":\"10734\",\"processID\":\"4\",\"threadID\":\"1936\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"323\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T21:58:02.8991491Z","eventRecordID":"10734","processID":"4","threadID":"1936","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"323"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.435+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.420085","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T21:58:03.4264145Z\",\"eventRecordID\":\"10735\",\"processID\":\"4\",\"threadID\":\"1936\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T21:58:03.4264145Z","eventRecordID":"10735","processID":"4","threadID":"1936","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.451+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":28,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.430308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:12.8379253Z\",\"eventRecordID\":\"10310993\",\"processID\":\"416\",\"threadID\":\"6468\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:12.8379253Z","eventRecordID":"10310993","processID":"416","threadID":"6468","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.460+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.430308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T21:58:30.5003192Z\",\"eventRecordID\":\"10736\",\"processID\":\"4\",\"threadID\":\"1936\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T21:58:03.426330300Z na ‎2022‎-‎12‎-‎02T21:58:30.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T21:58:30.5000000Z\",\"oldTime\":\"2022-12-02T21:58:03.4263303Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T21:58:30.5003192Z","eventRecordID":"10736","processID":"4","threadID":"1936","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T21:58:03.426330300Z na ‎2022‎-‎12‎-‎02T21:58:30.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T21:58:30.5000000Z","oldTime":"2022-12-02T21:58:03.4263303Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.486+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.430308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:12.8379419Z\",\"eventRecordID\":\"10310994\",\"processID\":\"416\",\"threadID\":\"6468\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:12.8379419Z","eventRecordID":"10310994","processID":"416","threadID":"6468","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.494+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.430308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T21:58:30.6565610Z\",\"eventRecordID\":\"10737\",\"processID\":\"4\",\"threadID\":\"1936\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 162, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"162\",\"fullResume\":\"439\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T21:58:30.6565610Z","eventRecordID":"10737","processID":"4","threadID":"1936","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 162, pełne wznowienie (FullResume): 439, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"162","fullResume":"439","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.520+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.430308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T21:58:31.0944691Z\",\"eventRecordID\":\"10738\",\"processID\":\"1144\",\"threadID\":\"13640\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T21:58:31.0944691Z","eventRecordID":"10738","processID":"1144","threadID":"13640","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.533+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":2,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.438416","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:12.9089091Z\",\"eventRecordID\":\"10310995\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEAC89DE\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xeac89de\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:12.9089091Z","eventRecordID":"10310995","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEAC89DE\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xeac89de","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.554+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.438416","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:16:30.3943857Z\",\"eventRecordID\":\"7279\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:16:30.3943857Z","eventRecordID":"7279","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.555+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.438416","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:58:32.9228932Z\",\"eventRecordID\":\"10739\",\"processID\":\"3908\",\"threadID\":\"16748\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T21:57:59.810365900Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T21:58:31.125602600Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T21:57:59.8103659Z\",\"wakeTime\":\"2022-12-02T21:58:31.1256026Z\",\"sleepDuration\":\"3347\",\"wakeDuration\":\"629\",\"driverInitDuration\":\"255\",\"biosInitDuration\":\"481\",\"hiberWriteDuration\":\"7241\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"275806\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"61\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:58:32.9228932Z","eventRecordID":"10739","processID":"3908","threadID":"16748","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T21:57:59.810365900Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T21:58:31.125602600Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T21:57:59.8103659Z","wakeTime":"2022-12-02T21:58:31.1256026Z","sleepDuration":"3347","wakeDuration":"629","driverInitDuration":"255","biosInitDuration":"481","hiberWriteDuration":"7241","hiberReadDuration":"0","hiberPagesWritten":"275806","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"61"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.568+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.438416","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T21:58:36.8096082Z\",\"eventRecordID\":\"10740\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T21:58:36.8096082Z","eventRecordID":"10740","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.584+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.438416","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:12.9089307Z\",\"eventRecordID\":\"10310996\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEAC89DE\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xeac89de\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:12.9089307Z","eventRecordID":"10310996","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEAC89DE\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xeac89de","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.597+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.438416","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:58:37.7380684Z\",\"eventRecordID\":\"10741\",\"processID\":\"1592\",\"threadID\":\"18892\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:58:37.7380684Z","eventRecordID":"10741","processID":"1592","threadID":"18892","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.612+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.438416","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:58:38.1833022Z\",\"eventRecordID\":\"10742\",\"processID\":\"1592\",\"threadID\":\"18892\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:58:38.1833022Z","eventRecordID":"10742","processID":"1592","threadID":"18892","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.629+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":3,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.446605","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:14.2093061Z\",\"eventRecordID\":\"10310997\",\"processID\":\"4\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:14.2093061Z","eventRecordID":"10310997","processID":"4","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.642+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.446605","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:58:40.3978395Z\",\"eventRecordID\":\"10743\",\"processID\":\"1592\",\"threadID\":\"18892\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:58:40.3978395Z","eventRecordID":"10743","processID":"1592","threadID":"18892","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.659+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.446605","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T21:58:41.9123120Z\",\"eventRecordID\":\"10744\",\"processID\":\"1592\",\"threadID\":\"16828\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T21:58:41.9123120Z","eventRecordID":"10744","processID":"1592","threadID":"16828","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.682+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":29,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.450033","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:14.2232518Z\",\"eventRecordID\":\"10310998\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:14.2232518Z","eventRecordID":"10310998","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.692+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.450033","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T22:08:15.9879336Z\",\"eventRecordID\":\"10745\",\"processID\":\"1144\",\"threadID\":\"15552\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T22:08:15.9879336Z","eventRecordID":"10745","processID":"1144","threadID":"15552","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.702+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.450033","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:16:31.6858714Z\",\"eventRecordID\":\"7280\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:16:31.6858714Z","eventRecordID":"7280","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.722+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":5,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.450033","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T22:18:17.7033763Z\",\"eventRecordID\":\"10746\",\"processID\":\"1012\",\"threadID\":\"14696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"uruchamianie na żądanie\",\"param3\":\"autostart\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T22:18:17.7033763Z","eventRecordID":"10746","processID":"1012","threadID":"14696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"uruchamianie na żądanie","param3":"autostart","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.754+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.458143","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:14.2232663Z\",\"eventRecordID\":\"10310999\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:14.2232663Z","eventRecordID":"10310999","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.758+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":6,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.460031","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T22:21:14.8284576Z\",\"eventRecordID\":\"10747\",\"processID\":\"1012\",\"threadID\":\"20356\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"autostart\",\"param3\":\"uruchamianie na żądanie\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T22:21:14.8284576Z","eventRecordID":"10747","processID":"1012","threadID":"20356","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"autostart","param3":"uruchamianie na żądanie","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.783+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.460031","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T22:28:59.9677870Z\",\"eventRecordID\":\"10748\",\"processID\":\"4\",\"threadID\":\"6484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"325\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T22:28:59.9677870Z","eventRecordID":"10748","processID":"4","threadID":"6484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"325"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.784+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":4,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.461919","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:14.2249234Z\",\"eventRecordID\":\"10311000\",\"processID\":\"4\",\"threadID\":\"16376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:14.2249234Z","eventRecordID":"10311000","processID":"4","threadID":"16376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.816+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.461919","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-02T22:29:28.5002985Z\",\"eventRecordID\":\"10750\",\"processID\":\"4\",\"threadID\":\"6484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T22:29:00.489458800Z na ‎2022‎-‎12‎-‎02T22:29:28.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-02T22:29:28.5000000Z\",\"oldTime\":\"2022-12-02T22:29:00.4894588Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-02T22:29:28.5002985Z","eventRecordID":"10750","processID":"4","threadID":"6484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T22:29:00.489458800Z na ‎2022‎-‎12‎-‎02T22:29:28.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-02T22:29:28.5000000Z","oldTime":"2022-12-02T22:29:00.4894588Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.816+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.461919","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T22:29:00.4895158Z\",\"eventRecordID\":\"10749\",\"processID\":\"4\",\"threadID\":\"6484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T22:29:00.4895158Z","eventRecordID":"10749","processID":"4","threadID":"6484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.836+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":30,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.461919","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:53.5652065Z\",\"eventRecordID\":\"10311001\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:53.5652065Z","eventRecordID":"10311001","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.845+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.465143","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T22:29:28.6556980Z\",\"eventRecordID\":\"10751\",\"processID\":\"4\",\"threadID\":\"6484\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 163, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"163\",\"fullResume\":\"440\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T22:29:28.6556980Z","eventRecordID":"10751","processID":"4","threadID":"6484","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 163, pełne wznowienie (FullResume): 440, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"163","fullResume":"440","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.859+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.465143","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:46:51.4203922Z\",\"eventRecordID\":\"7281\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:46:51.4203922Z","eventRecordID":"7281","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.878+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.465143","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T22:29:29.0963188Z\",\"eventRecordID\":\"10752\",\"processID\":\"1144\",\"threadID\":\"11792\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T22:29:29.0963188Z","eventRecordID":"10752","processID":"1144","threadID":"11792","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.894+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.465143","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:54:53.5652241Z\",\"eventRecordID\":\"10311002\",\"processID\":\"416\",\"threadID\":\"20356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:54:53.5652241Z","eventRecordID":"10311002","processID":"416","threadID":"20356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.909+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.465143","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:29:30.8938618Z\",\"eventRecordID\":\"10753\",\"processID\":\"3908\",\"threadID\":\"9284\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T22:28:56.859647300Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T22:29:29.127571400Z\\r\\n\\r\\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T22:28:56.8596473Z\",\"wakeTime\":\"2022-12-02T22:29:29.1275714Z\",\"sleepDuration\":\"3360\",\"wakeDuration\":\"629\",\"driverInitDuration\":\"233\",\"biosInitDuration\":\"482\",\"hiberWriteDuration\":\"7017\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"275806\",\"attributes\":\"1912624129\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"5\",\"wakeSourceTextLength\":\"34\",\"wakeSourceText\":\"Realtek PCIe GbE Family Controller\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"50\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:29:30.8938618Z","eventRecordID":"10753","processID":"3908","threadID":"9284","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T22:28:56.859647300Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎02T22:29:29.127571400Z\r\n\r\nŹródło wznowienia: Urządzenie —Realtek PCIe GbE Family Controller\""},"eventdata":{"sleepTime":"2022-12-02T22:28:56.8596473Z","wakeTime":"2022-12-02T22:29:29.1275714Z","sleepDuration":"3360","wakeDuration":"629","driverInitDuration":"233","biosInitDuration":"482","hiberWriteDuration":"7017","hiberReadDuration":"0","hiberPagesWritten":"275806","attributes":"1912624129","targetState":"4","effectiveState":"5","wakeSourceType":"5","wakeSourceTextLength":"34","wakeSourceText":"Realtek PCIe GbE Family Controller","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"50"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.928+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.465143","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-02T22:29:35.0440280Z\",\"eventRecordID\":\"10754\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-02T22:29:35.0440280Z","eventRecordID":"10754","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.947+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":31,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.465143","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:57:38.9678813Z\",\"eventRecordID\":\"10311003\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:57:38.9678813Z","eventRecordID":"10311003","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.959+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:29:35.7187898Z\",\"eventRecordID\":\"10755\",\"processID\":\"1592\",\"threadID\":\"18696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:29:35.7187898Z","eventRecordID":"10755","processID":"1592","threadID":"18696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.972+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:29:36.1764149Z\",\"eventRecordID\":\"10756\",\"processID\":\"1592\",\"threadID\":\"18696\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:29:36.1764149Z","eventRecordID":"10756","processID":"1592","threadID":"18696","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:06.982+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315166.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:57:38.9679196Z\",\"eventRecordID\":\"10311004\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:57:38.9679196Z","eventRecordID":"10311004","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.003+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:29:38.4140907Z\",\"eventRecordID\":\"10757\",\"processID\":\"1592\",\"threadID\":\"16828\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:29:38.4140907Z","eventRecordID":"10757","processID":"1592","threadID":"16828","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.011+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:47:20.9759724Z\",\"eventRecordID\":\"7282\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:47:20.9759724Z","eventRecordID":"7282","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.032+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-02T22:29:39.9250721Z\",\"eventRecordID\":\"10758\",\"processID\":\"1592\",\"threadID\":\"16828\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-02T22:29:39.9250721Z","eventRecordID":"10758","processID":"1592","threadID":"16828","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.043+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-02T22:39:14.6721020Z\",\"eventRecordID\":\"10759\",\"processID\":\"1144\",\"threadID\":\"20344\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-02T22:39:14.6721020Z","eventRecordID":"10759","processID":"1144","threadID":"20344","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.063+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":32,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.473253","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:58:19.4055097Z\",\"eventRecordID\":\"10311005\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:58:19.4055097Z","eventRecordID":"10311005","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.078+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.481361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T11:58:19.4055264Z\",\"eventRecordID\":\"10311006\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T11:58:19.4055264Z","eventRecordID":"10311006","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.089+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.481361","full_log":"{\"win\":{\"system\":{\"providerName\":\"EventLog\",\"eventID\":\"6013\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:24:46.9476961Z\",\"eventRecordID\":\"10760\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas pracy systemu wynosi 1297409 s.\\\"\"},\"eventdata\":{\"binary\":\" \",\"data\":\"1297409, 60, -60 Środkowoeuropejski czas stand.\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"EventLog","eventID":"6013","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:24:46.9476961Z","eventRecordID":"10760","processID":"0","threadID":"0","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas pracy systemu wynosi 1297409 s.\""},"eventdata":{"binary":" ","data":"1297409, 60, -60 Środkowoeuropejski czas stand."}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.108+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.481361","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"42\",\"version\":\"3\",\"level\":\"4\",\"task\":\"64\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-02T23:01:57.8340047Z\",\"eventRecordID\":\"10761\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System przechodzi do trybu uśpienia.\\r\\n\\r\\nPrzyczyna: System Idle\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"reason\":\"7\",\"flags\":\"0\",\"transitionsToOn\":\"327\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"42","version":"3","level":"4","task":"64","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-02T23:01:57.8340047Z","eventRecordID":"10761","processID":"4","threadID":"12512","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System przechodzi do trybu uśpienia.\r\n\r\nPrzyczyna: System Idle\""},"eventdata":{"targetState":"4","effectiveState":"5","reason":"7","flags":"0","transitionsToOn":"327"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.117+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.481361","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:47:21.0094926Z\",\"eventRecordID\":\"7283\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:47:21.0094926Z","eventRecordID":"7283","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.141+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":33,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.489469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:03:34.5766914Z\",\"eventRecordID\":\"10311007\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:03:34.5766914Z","eventRecordID":"10311007","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.148+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.489469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"107\",\"version\":\"1\",\"level\":\"4\",\"task\":\"102\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000444\",\"systemTime\":\"2022-12-02T23:01:58.3663501Z\",\"eventRecordID\":\"10762\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System został wznowiony ze stanu uśpienia.\\\"\"},\"eventdata\":{\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeFromState\":\"4\",\"programmedWakeTimeAc\":\"1601-01-01T00:00:00.0000000Z\",\"programmedWakeTimeDc\":\"1601-01-01T00:00:00.0000000Z\",\"wakeRequesterTypeAc\":\"0\",\"wakeRequesterTypeDc\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"107","version":"1","level":"4","task":"102","opcode":"0","keywords":"0x8000000000000444","systemTime":"2022-12-02T23:01:58.3663501Z","eventRecordID":"10762","processID":"4","threadID":"12512","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System został wznowiony ze stanu uśpienia.\""},"eventdata":{"targetState":"4","effectiveState":"5","wakeFromState":"4","programmedWakeTimeAc":"1601-01-01T00:00:00.0000000Z","programmedWakeTimeDc":"1601-01-01T00:00:00.0000000Z","wakeRequesterTypeAc":"0","wakeRequesterTypeDc":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.171+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.489469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:03:34.5767296Z\",\"eventRecordID\":\"10311008\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:03:34.5767296Z","eventRecordID":"10311008","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.197+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.489469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:46.5852698Z\",\"eventRecordID\":\"10764\",\"processID\":\"1592\",\"threadID\":\"19648\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:46.5852698Z","eventRecordID":"10764","processID":"1592","threadID":"19648","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.197+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.489469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-General\",\"providerGuid\":\"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}\",\"eventID\":\"1\",\"version\":\"2\",\"level\":\"4\",\"task\":\"5\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000010\",\"systemTime\":\"2022-12-06T08:24:46.5002922Z\",\"eventRecordID\":\"10763\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T23:01:58.366305900Z na ‎2022‎-‎12‎-‎06T08:24:46.500000000Z.\\r\\n\\r\\nPrzyczyna zmiany: System time synchronized with the hardware clock.\\r\\nProces: „” (identyfikator PID: 4).\\\"\"},\"eventdata\":{\"newTime\":\"2022-12-06T08:24:46.5000000Z\",\"oldTime\":\"2022-12-02T23:01:58.3663059Z\",\"reason\":\"2\",\"processID\":\"4\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-General","providerGuid":"{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}","eventID":"1","version":"2","level":"4","task":"5","opcode":"0","keywords":"0x8000000000000010","systemTime":"2022-12-06T08:24:46.5002922Z","eventRecordID":"10763","processID":"4","threadID":"12512","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czas systemowy został zmieniony z ‎2022‎-‎12‎-‎02T23:01:58.366305900Z na ‎2022‎-‎12‎-‎06T08:24:46.500000000Z.\r\n\r\nPrzyczyna zmiany: System time synchronized with the hardware clock.\r\nProces: „” (identyfikator PID: 4).\""},"eventdata":{"newTime":"2022-12-06T08:24:46.5000000Z","oldTime":"2022-12-02T23:01:58.3663059Z","reason":"2","processID":"4"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.227+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.489469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Kernel-Power\",\"providerGuid\":\"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}\",\"eventID\":\"131\",\"version\":\"0\",\"level\":\"4\",\"task\":\"33\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000404\",\"systemTime\":\"2022-12-06T08:24:46.7360371Z\",\"eventRecordID\":\"10765\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 164, pełne wznowienie (FullResume): 436, średnie wznowienie (AverageResume): 439\\\"\"},\"eventdata\":{\"resumeCount\":\"164\",\"fullResume\":\"436\",\"averageResume\":\"439\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Kernel-Power","providerGuid":"{331c3b3a-2005-44c2-ac5e-77220c37d6b4}","eventID":"131","version":"0","level":"4","task":"33","opcode":"0","keywords":"0x8000000000000404","systemTime":"2022-12-06T08:24:46.7360371Z","eventRecordID":"10765","processID":"4","threadID":"12512","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Czasy S3 oprogramowania układowego. Liczba wznowień (ResumeCount): 164, pełne wznowienie (FullResume): 436, średnie wznowienie (AverageResume): 439\""},"eventdata":{"resumeCount":"164","fullResume":"436","averageResume":"439"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.239+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":34,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.497577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:05:55.4158652Z\",\"eventRecordID\":\"10311009\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:05:55.4158652Z","eventRecordID":"10311009","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.259+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.497577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:47.1200632Z\",\"eventRecordID\":\"10766\",\"processID\":\"1592\",\"threadID\":\"19648\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:47.1200632Z","eventRecordID":"10766","processID":"1592","threadID":"19648","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.260+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.497577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:47.2409056Z\",\"eventRecordID\":\"10767\",\"processID\":\"1592\",\"threadID\":\"13148\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:47.2409056Z","eventRecordID":"10767","processID":"1592","threadID":"13148","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.294+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.497577","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:47:28.2926396Z\",\"eventRecordID\":\"7284\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:47:28.2926396Z","eventRecordID":"7284","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.294+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":7,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.505687","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:24:47.2523420Z\",\"eventRecordID\":\"10768\",\"processID\":\"1012\",\"threadID\":\"15536\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"uruchamianie na żądanie\",\"param3\":\"autostart\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:24:47.2523420Z","eventRecordID":"10768","processID":"1012","threadID":"15536","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"uruchamianie na żądanie","param3":"autostart","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.320+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.505687","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:05:55.4158825Z\",\"eventRecordID\":\"10311010\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:05:55.4158825Z","eventRecordID":"10311010","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.327+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.505687","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Power-Troubleshooter\",\"providerGuid\":\"{cdc05e28-c449-49c6-b9d2-88cf761644df}\",\"eventID\":\"1\",\"version\":\"3\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:48.0347946Z\",\"eventRecordID\":\"10769\",\"processID\":\"3908\",\"threadID\":\"14868\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"System wrócił ze stanu niskiego poboru energii.\\r\\n\\r\\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T23:01:54.872119700Z\\r\\nGodzina wznowienia: ‎2022‎-‎12‎-‎06T08:24:47.325290200Z\\r\\n\\r\\nŹródło wznowienia: Przycisk zasilania\\\"\"},\"eventdata\":{\"sleepTime\":\"2022-12-02T23:01:54.8721197Z\",\"wakeTime\":\"2022-12-06T08:24:47.3252902Z\",\"sleepDuration\":\"3215\",\"wakeDuration\":\"824\",\"driverInitDuration\":\"230\",\"biosInitDuration\":\"477\",\"hiberWriteDuration\":\"6832\",\"hiberReadDuration\":\"0\",\"hiberPagesWritten\":\"269316\",\"attributes\":\"1912622081\",\"targetState\":\"4\",\"effectiveState\":\"5\",\"wakeSourceType\":\"1\",\"wakeSourceTextLength\":\"0\",\"wakeTimerOwnerLength\":\"0\",\"wakeTimerContextLength\":\"0\",\"noMultiStageResumeReason\":\"0\",\"checkpointDuration\":\"41\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Power-Troubleshooter","providerGuid":"{cdc05e28-c449-49c6-b9d2-88cf761644df}","eventID":"1","version":"3","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:48.0347946Z","eventRecordID":"10769","processID":"3908","threadID":"14868","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"System wrócił ze stanu niskiego poboru energii.\r\n\r\nGodzina uśpienia: ‎2022‎-‎12‎-‎02T23:01:54.872119700Z\r\nGodzina wznowienia: ‎2022‎-‎12‎-‎06T08:24:47.325290200Z\r\n\r\nŹródło wznowienia: Przycisk zasilania\""},"eventdata":{"sleepTime":"2022-12-02T23:01:54.8721197Z","wakeTime":"2022-12-06T08:24:47.3252902Z","sleepDuration":"3215","wakeDuration":"824","driverInitDuration":"230","biosInitDuration":"477","hiberWriteDuration":"6832","hiberReadDuration":"0","hiberPagesWritten":"269316","attributes":"1912622081","targetState":"4","effectiveState":"5","wakeSourceType":"1","wakeSourceTextLength":"0","wakeTimerOwnerLength":"0","wakeTimerContextLength":"0","noMultiStageResumeReason":"0","checkpointDuration":"41"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.351+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.505687","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:52.4444344Z\",\"eventRecordID\":\"10770\",\"processID\":\"1592\",\"threadID\":\"13848\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:52.4444344Z","eventRecordID":"10770","processID":"1592","threadID":"13848","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.362+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":35,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.507575","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:08:54.2598776Z\",\"eventRecordID\":\"10311011\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:08:54.2598776Z","eventRecordID":"10311011","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.382+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.507575","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:24:57.1870229Z\",\"eventRecordID\":\"10771\",\"processID\":\"1592\",\"threadID\":\"19648\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:24:57.1870229Z","eventRecordID":"10771","processID":"1592","threadID":"19648","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.387+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.507575","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8019\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-06T08:24:58.8303371Z\",\"eventRecordID\":\"10772\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach: \\r\\n\\r\\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\\r\\n           Nazwa hosta: PC15\\r\\n           Sufiks domeny podstawowej: DOMAIN.pl\\r\\n           Lista serwerów DNS: \\r\\n             \\t192.168.1.202, 1.1.1.1\\r\\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\\r\\n           Adresy IP: \\r\\n             192.168.1.102\\r\\n\\r\\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\\r\\n\\r\\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\\\"\"},\"eventdata\":{\"adapterName\":\"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.1.202, 1.1.1.1\",\"sent UpdateServer\":\"195.114.173.153:53\",\"ipaddress\":\"192.168.1.102\",\"errorCode\":\"9017\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8019","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-06T08:24:58.8303371Z","eventRecordID":"10772","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach: \r\n\r\n           Nazwa karty: {F15F7F75-3508-41FF-B381-D2DC0B737FB9}\r\n           Nazwa hosta: PC15\r\n           Sufiks domeny podstawowej: DOMAIN.pl\r\n           Lista serwerów DNS: \r\n             \t192.168.1.202, 1.1.1.1\r\n           Aktualizacja wysłana do serwera: 195.114.173.153:53\r\n           Adresy IP: \r\n             192.168.1.102\r\n\r\nSystem nie może zarejestrować tych rekordów RR z powodu problemu związanego z zabezpieczeniami. Mógł on wystąpić, ponieważ (a) komputer nie ma uprawnień do rejestrowania i aktualizowania określonej nazwy domeny DNS dla tej karty lub (b) podczas przetwarzania żądania aktualizacji wystąpił problem dotyczący negocjowania prawidłowych poświadczeń z serwerem DNS.\r\n\r\nMożesz ręcznie ponowić próbę rejestracji karty sieciowej i jej ustawień w usłudze DNS, wpisując „ipconfig /registerdns” w wierszu polecenia. Jeśli problemy będą się powtarzać, skontaktuj się z administratorem systemów sieciowych lub serwera DNS. Aby uzyskać informacje o konkretnym kodzie błędu, zobacz szczegóły zdarzenia.\""},"eventdata":{"adapterName":"{F15F7F75-3508-41FF-B381-D2DC0B737FB9}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.1.202, 1.1.1.1","sent UpdateServer":"195.114.173.153:53","ipaddress":"192.168.1.102","errorCode":"9017"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.414+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.507575","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:08:54.2599020Z\",\"eventRecordID\":\"10311012\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:08:54.2599020Z","eventRecordID":"10311012","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.419+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.507575","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T16:47:29.5479458Z\",\"eventRecordID\":\"7285\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T16:47:29.5479458Z","eventRecordID":"7285","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.443+0000","rule":{"level":5,"description":"Windows System error event","id":"61102","firedtimes":15,"mail":false,"groups":["windows","windows_system","system_error"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.515685","full_log":"{\"win\":{\"system\":{\"providerName\":\"NETLOGON\",\"eventID\":\"5719\",\"version\":\"0\",\"level\":\"2\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:25:01.1076117Z\",\"eventRecordID\":\"10773\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"ERROR\",\"message\":\"\\\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \\r\\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \\r\\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \\r\\n\\r\\nINFORMACJE DODATKOWE \\r\\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\\\"\"},\"eventdata\":{\"binary\":\"5E0000C0\",\"data\":\"DOMAIN, %%1311\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"NETLOGON","eventID":"5719","version":"0","level":"2","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:25:01.1076117Z","eventRecordID":"10773","processID":"0","threadID":"0","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"ERROR","message":"\"Ten komputer nie może skonfigurować zabezpieczonej sesji z kontrolerem domeny w domenie DOMAIN z następującego powodu: \r\nNie możemy zalogować Cię za pomocą tego poświadczenia, ponieważ Twoja domena jest niedostępna. Upewnij się, że to urządzenie jest podłączone do sieci Twojej organizacji i spróbuj ponownie. Jeśli uprzednio logowano się na tym urządzeniu przy użyciu innego poświadczenia, możesz zalogować się za pomocą tego poświadczenia. \r\nTo może powodować problemy z uwierzytelnianiem. Upewnij się, że ten komputer jest podłączony do sieci. Jeżeli problem się nie rozwiąże, skontaktuj się z administratorem domeny.  \r\n\r\nINFORMACJE DODATKOWE \r\nJeżeli ten komputer jest kontrolerem domeny dla określonej domeny, konfiguruje zabezpieczoną sesję z emulatorem podstawowego kontrolera domeny w określonej  domenie. W przeciwnym przypadku komputer może skonfigurować zabezpieczoną sesję z dowolnym kontrolerem domeny  w określonej domenie.\""},"eventdata":{"binary":"5E0000C0","data":"DOMAIN, %%1311"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.454+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":36,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.515685","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:08:54.2757502Z\",\"eventRecordID\":\"10311013\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:08:54.2757502Z","eventRecordID":"10311013","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.474+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.518779","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:25:31.1616811Z\",\"eventRecordID\":\"10774\",\"processID\":\"1144\",\"threadID\":\"15340\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:25:31.1616811Z","eventRecordID":"10774","processID":"1144","threadID":"15340","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.483+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.518779","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:08:54.2757669Z\",\"eventRecordID\":\"10311014\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:08:54.2757669Z","eventRecordID":"10311014","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.516+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.518779","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"37\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:25:59.6320605Z\",\"eventRecordID\":\"10776\",\"processID\":\"1592\",\"threadID\":\"19648\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"The time provider NtpClient is currently receiving valid time data from dc2.DOMAIN.pl (ntp.d|0.0.0.0:123->192.168.60.154:123).\\\"\"},\"eventdata\":{\"timeSource\":\"dc2.DOMAIN.pl (ntp.d|0.0.0.0:123-&gt;192.168.60.154:123)\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"37","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:25:59.6320605Z","eventRecordID":"10776","processID":"1592","threadID":"19648","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"The time provider NtpClient is currently receiving valid time data from dc2.DOMAIN.pl (ntp.d|0.0.0.0:123->192.168.60.154:123).\""},"eventdata":{"timeSource":"dc2.DOMAIN.pl (ntp.d|0.0.0.0:123-&gt;192.168.60.154:123)"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.515+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.518779","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Time-Service\",\"providerGuid\":\"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}\",\"eventID\":\"129\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8000000000000000\",\"systemTime\":\"2022-12-06T08:25:56.1303203Z\",\"eventRecordID\":\"10775\",\"processID\":\"1592\",\"threadID\":\"13148\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\\\"\"},\"eventdata\":{\"errorMessage\":\"Nie można odnaleźć wpisu. (0x800706E1)\",\"retryMinutes\":\"15\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Time-Service","providerGuid":"{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}","eventID":"129","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8000000000000000","systemTime":"2022-12-06T08:25:56.1303203Z","eventRecordID":"10775","processID":"1592","threadID":"13148","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: Nie można odnaleźć wpisu. (0x800706E1)\""},"eventdata":{"errorMessage":"Nie można odnaleźć wpisu. (0x800706E1)","retryMinutes":"15"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.538+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.518779","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:26:00.6811305Z\",\"eventRecordID\":\"10777\",\"processID\":\"1144\",\"threadID\":\"19232\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:26:00.6811305Z","eventRecordID":"10777","processID":"1144","threadID":"19232","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.548+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":37,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.526889","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:08:56.4613183Z\",\"eventRecordID\":\"10311015\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:08:56.4613183Z","eventRecordID":"10311015","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.566+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.526889","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:17:49.5319341Z\",\"eventRecordID\":\"7286\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:17:49.5319341Z","eventRecordID":"7286","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.582+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.526889","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:08:56.4613335Z\",\"eventRecordID\":\"10311016\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:08:56.4613335Z","eventRecordID":"10311016","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.603+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":38,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.534999","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:12:55.7994689Z\",\"eventRecordID\":\"10311017\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:12:55.7994689Z","eventRecordID":"10311017","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.628+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.534999","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:12:55.7994866Z\",\"eventRecordID\":\"10311018\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:12:55.7994866Z","eventRecordID":"10311018","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.633+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.534999","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:18:19.9784460Z\",\"eventRecordID\":\"7287\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:18:19.9784460Z","eventRecordID":"7287","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.649+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":39,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.543109","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:12:57.4106997Z\",\"eventRecordID\":\"10311019\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:12:57.4106997Z","eventRecordID":"10311019","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.666+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.543109","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:12:57.4107149Z\",\"eventRecordID\":\"10311020\",\"processID\":\"416\",\"threadID\":\"14624\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:12:57.4107149Z","eventRecordID":"10311020","processID":"416","threadID":"14624","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.681+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":40,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.551219","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:15:39.2198407Z\",\"eventRecordID\":\"10311021\",\"processID\":\"416\",\"threadID\":\"5544\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:15:39.2198407Z","eventRecordID":"10311021","processID":"416","threadID":"5544","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.694+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.551219","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:18:20.0105958Z\",\"eventRecordID\":\"7288\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:18:20.0105958Z","eventRecordID":"7288","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.714+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.551219","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:15:39.2198776Z\",\"eventRecordID\":\"10311022\",\"processID\":\"416\",\"threadID\":\"5544\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:15:39.2198776Z","eventRecordID":"10311022","processID":"416","threadID":"5544","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.729+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":41,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.559327","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:18:25.0802381Z\",\"eventRecordID\":\"10311023\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:18:25.0802381Z","eventRecordID":"10311023","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.742+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.559327","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:18:27.2902864Z\",\"eventRecordID\":\"7289\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:18:27.2902864Z","eventRecordID":"7289","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.764+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.559327","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:18:25.0802754Z\",\"eventRecordID\":\"10311024\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:18:25.0802754Z","eventRecordID":"10311024","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.782+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.559327","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:18:25.4738522Z\",\"eventRecordID\":\"10311025\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-544\\r\\n\\tNazwa grupy:\\t\\tAdministratorzy\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4d88\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administratorzy\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-544\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4d88\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:18:25.4738522Z","eventRecordID":"10311025","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-544\r\n\tNazwa grupy:\t\tAdministratorzy\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4d88\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Administratorzy","targetDomainName":"Builtin","targetSid":"S-1-5-32-544","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4d88","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.786+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.559327","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:18:25.4749873Z\",\"eventRecordID\":\"10311026\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-551\\r\\n\\tNazwa grupy:\\t\\tOperatorzy kopii zapasowych\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4d88\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Operatorzy kopii zapasowych\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-551\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4d88\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:18:25.4749873Z","eventRecordID":"10311026","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-551\r\n\tNazwa grupy:\t\tOperatorzy kopii zapasowych\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4d88\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Operatorzy kopii zapasowych","targetDomainName":"Builtin","targetSid":"S-1-5-32-551","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4d88","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.807+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":42,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.567437","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:19:34.1978593Z\",\"eventRecordID\":\"10311027\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:19:34.1978593Z","eventRecordID":"10311027","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.813+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.567437","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:18:28.5825048Z\",\"eventRecordID\":\"7290\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:18:28.5825048Z","eventRecordID":"7290","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.844+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.567437","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:19:34.1978784Z\",\"eventRecordID\":\"10311028\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:19:34.1978784Z","eventRecordID":"10311028","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.859+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":43,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.575547","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:19:35.9202992Z\",\"eventRecordID\":\"10311029\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:19:35.9202992Z","eventRecordID":"10311029","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.875+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.575547","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:19:35.9203141Z\",\"eventRecordID\":\"10311030\",\"processID\":\"416\",\"threadID\":\"12676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:19:35.9203141Z","eventRecordID":"10311030","processID":"416","threadID":"12676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.877+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.575547","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:48:48.3633576Z\",\"eventRecordID\":\"7291\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:48:48.3633576Z","eventRecordID":"7291","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.894+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":44,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.583657","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:22:26.2349760Z\",\"eventRecordID\":\"10311031\",\"processID\":\"416\",\"threadID\":\"3564\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:22:26.2349760Z","eventRecordID":"10311031","processID":"416","threadID":"3564","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.911+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.583657","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:22:26.2350110Z\",\"eventRecordID\":\"10311032\",\"processID\":\"416\",\"threadID\":\"3564\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:22:26.2350110Z","eventRecordID":"10311032","processID":"416","threadID":"3564","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.925+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":45,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.583657","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:23:36.4195397Z\",\"eventRecordID\":\"10311033\",\"processID\":\"416\",\"threadID\":\"3564\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:23:36.4195397Z","eventRecordID":"10311033","processID":"416","threadID":"3564","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.951+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.591765","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:49:18.9770925Z\",\"eventRecordID\":\"7292\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:49:18.9770925Z","eventRecordID":"7292","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.954+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.591765","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:23:36.4195562Z\",\"eventRecordID\":\"10311034\",\"processID\":\"416\",\"threadID\":\"3564\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:23:36.4195562Z","eventRecordID":"10311034","processID":"416","threadID":"3564","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.971+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":46,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.591765","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:25:53.1706367Z\",\"eventRecordID\":\"10311035\",\"processID\":\"416\",\"threadID\":\"18524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:25:53.1706367Z","eventRecordID":"10311035","processID":"416","threadID":"18524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.986+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.599873","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:25:53.1706714Z\",\"eventRecordID\":\"10311036\",\"processID\":\"416\",\"threadID\":\"18524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:25:53.1706714Z","eventRecordID":"10311036","processID":"416","threadID":"18524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:07.994+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315167.599873","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:49:19.0061966Z\",\"eventRecordID\":\"7293\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:49:19.0061966Z","eventRecordID":"7293","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.017+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":47,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.599873","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:27:13.6503488Z\",\"eventRecordID\":\"10311037\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:27:13.6503488Z","eventRecordID":"10311037","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.042+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.607983","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:27:13.6503650Z\",\"eventRecordID\":\"10311038\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:27:13.6503650Z","eventRecordID":"10311038","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.057+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":48,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.616091","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:30:46.7952448Z\",\"eventRecordID\":\"10311039\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:30:46.7952448Z","eventRecordID":"10311039","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.073+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.616091","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:49:26.3155369Z\",\"eventRecordID\":\"7294\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:49:26.3155369Z","eventRecordID":"7294","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.076+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.616091","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:30:46.7952838Z\",\"eventRecordID\":\"10311040\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:30:46.7952838Z","eventRecordID":"10311040","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.094+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":49,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.616091","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:39:54.7798956Z\",\"eventRecordID\":\"10311041\",\"processID\":\"416\",\"threadID\":\"9220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:39:54.7798956Z","eventRecordID":"10311041","processID":"416","threadID":"9220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.111+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.624199","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:39:54.7799315Z\",\"eventRecordID\":\"10311042\",\"processID\":\"416\",\"threadID\":\"9220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:39:54.7799315Z","eventRecordID":"10311042","processID":"416","threadID":"9220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.125+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":50,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.624199","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:39:54.8226996Z\",\"eventRecordID\":\"10311043\",\"processID\":\"416\",\"threadID\":\"9220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:39:54.8226996Z","eventRecordID":"10311043","processID":"416","threadID":"9220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.152+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.632307","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T17:49:27.5529402Z\",\"eventRecordID\":\"7295\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T17:49:27.5529402Z","eventRecordID":"7295","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.154+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.632307","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:39:54.8227328Z\",\"eventRecordID\":\"10311044\",\"processID\":\"416\",\"threadID\":\"9220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:39:54.8227328Z","eventRecordID":"10311044","processID":"416","threadID":"9220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.185+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.640415","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:09:56.0060620Z\",\"eventRecordID\":\"7296\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:09:56.0060620Z","eventRecordID":"7296","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.185+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":4,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.640415","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:10:26.3341993Z\",\"eventRecordID\":\"7297\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T18:10:26Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-08T18:10:26Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:10:26.3341993Z","eventRecordID":"7297","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T18:10:26Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-08T18:10:26Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.203+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":51,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.641998","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:43:31.0765537Z\",\"eventRecordID\":\"10311045\",\"processID\":\"416\",\"threadID\":\"9220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:43:31.0765537Z","eventRecordID":"10311045","processID":"416","threadID":"9220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.219+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.641998","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:43:31.0765871Z\",\"eventRecordID\":\"10311046\",\"processID\":\"416\",\"threadID\":\"9220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:43:31.0765871Z","eventRecordID":"10311046","processID":"416","threadID":"9220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.231+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.641998","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:19:47.4904131Z\",\"eventRecordID\":\"7298\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:19:47.4904131Z","eventRecordID":"7298","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.251+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":52,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.650106","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:44:37.3050915Z\",\"eventRecordID\":\"10311047\",\"processID\":\"416\",\"threadID\":\"18532\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:44:37.3050915Z","eventRecordID":"10311047","processID":"416","threadID":"18532","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.265+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.650106","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:44:37.3051075Z\",\"eventRecordID\":\"10311048\",\"processID\":\"416\",\"threadID\":\"18532\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:44:37.3051075Z","eventRecordID":"10311048","processID":"416","threadID":"18532","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.279+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":53,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.658216","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:44:39.4910951Z\",\"eventRecordID\":\"10311049\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:44:39.4910951Z","eventRecordID":"10311049","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.306+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.658216","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:20:16.9899650Z\",\"eventRecordID\":\"7299\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:20:16.9899650Z","eventRecordID":"7299","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.309+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.658216","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:44:39.4911096Z\",\"eventRecordID\":\"10311050\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:44:39.4911096Z","eventRecordID":"10311050","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.325+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":54,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.658216","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:45:47.8398375Z\",\"eventRecordID\":\"10311051\",\"processID\":\"416\",\"threadID\":\"18740\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:45:47.8398375Z","eventRecordID":"10311051","processID":"416","threadID":"18740","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.345+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:45:47.8398801Z\",\"eventRecordID\":\"10311052\",\"processID\":\"416\",\"threadID\":\"18740\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:45:47.8398801Z","eventRecordID":"10311052","processID":"416","threadID":"18740","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.355+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:20:17.0125150Z\",\"eventRecordID\":\"7300\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:20:17.0125150Z","eventRecordID":"7300","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.458+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:48:31.7907148Z\",\"eventRecordID\":\"10311054\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:48:31.7907148Z","eventRecordID":"10311054","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.459+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":55,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:48:38.3237927Z\",\"eventRecordID\":\"10311055\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:48:38.3237927Z","eventRecordID":"10311055","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.459+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":56,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:48:31.7906986Z\",\"eventRecordID\":\"10311053\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:48:31.7906986Z","eventRecordID":"10311053","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.459+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:20:29.2922236Z\",\"eventRecordID\":\"7301\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:20:29.2922236Z","eventRecordID":"7301","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.459+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:48:38.3238110Z\",\"eventRecordID\":\"10311056\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:48:38.3238110Z","eventRecordID":"10311056","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.459+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":57,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.666324","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:48:39.9344207Z\",\"eventRecordID\":\"10311057\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:48:39.9344207Z","eventRecordID":"10311057","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.474+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.690650","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:48:39.9344357Z\",\"eventRecordID\":\"10311058\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:48:39.9344357Z","eventRecordID":"10311058","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.478+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.690650","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:20:30.5535009Z\",\"eventRecordID\":\"7302\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:20:30.5535009Z","eventRecordID":"7302","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.506+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":58,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.698758","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:56:30.9275832Z\",\"eventRecordID\":\"10311059\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:56:30.9275832Z","eventRecordID":"10311059","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.517+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.698758","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:56:30.9276202Z\",\"eventRecordID\":\"10311060\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:56:30.9276202Z","eventRecordID":"10311060","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.537+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.698758","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:50:45.4130314Z\",\"eventRecordID\":\"7303\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:50:45.4130314Z","eventRecordID":"7303","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.544+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":59,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.706866","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:59:59.6571360Z\",\"eventRecordID\":\"10311061\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:59:59.6571360Z","eventRecordID":"10311061","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.559+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.706866","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T12:59:59.6571705Z\",\"eventRecordID\":\"10311062\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T12:59:59.6571705Z","eventRecordID":"10311062","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.574+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":60,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.714974","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:51.4924322Z\",\"eventRecordID\":\"10311063\",\"processID\":\"416\",\"threadID\":\"19136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:51.4924322Z","eventRecordID":"10311063","processID":"416","threadID":"19136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.588+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.714974","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:51:13.9745681Z\",\"eventRecordID\":\"7304\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:51:13.9745681Z","eventRecordID":"7304","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.604+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.714974","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:51.4924495Z\",\"eventRecordID\":\"10311064\",\"processID\":\"416\",\"threadID\":\"19136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:51.4924495Z","eventRecordID":"10311064","processID":"416","threadID":"19136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.619+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":61,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.723084","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:51.4940702Z\",\"eventRecordID\":\"10311065\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:51.4940702Z","eventRecordID":"10311065","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.639+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.723084","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:51.4940906Z\",\"eventRecordID\":\"10311066\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:51.4940906Z","eventRecordID":"10311066","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.642+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.723084","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:51:14.0070867Z\",\"eventRecordID\":\"7305\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:51:14.0070867Z","eventRecordID":"7305","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.662+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":62,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.731192","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:54.2820916Z\",\"eventRecordID\":\"10311067\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:54.2820916Z","eventRecordID":"10311067","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.675+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.731192","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:54.2821066Z\",\"eventRecordID\":\"10311068\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:54.2821066Z","eventRecordID":"10311068","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.686+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.731192","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:51:22.7660989Z\",\"eventRecordID\":\"7306\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:51:22.7660989Z","eventRecordID":"7306","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.709+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":63,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.739300","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:59.9966214Z\",\"eventRecordID\":\"10311069\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:59.9966214Z","eventRecordID":"10311069","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.723+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.739300","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:08:59.9966459Z\",\"eventRecordID\":\"10311070\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:08:59.9966459Z","eventRecordID":"10311070","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.739+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":64,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.747408","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:00.0002270Z\",\"eventRecordID\":\"10311071\",\"processID\":\"416\",\"threadID\":\"19868\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:00.0002270Z","eventRecordID":"10311071","processID":"416","threadID":"19868","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.752+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.747408","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T18:51:24.0392149Z\",\"eventRecordID\":\"7307\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T18:51:24.0392149Z","eventRecordID":"7307","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.773+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.747408","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:00.0002541Z\",\"eventRecordID\":\"10311072\",\"processID\":\"416\",\"threadID\":\"19868\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:00.0002541Z","eventRecordID":"10311072","processID":"416","threadID":"19868","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.788+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":3,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.755518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:09.9498206Z\",\"eventRecordID\":\"10311073\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEDB496A\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xedb496a\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:09.9498206Z","eventRecordID":"10311073","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEDB496A\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xedb496a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.804+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.755518","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:23:12.4611129Z\",\"eventRecordID\":\"7308\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:23:12.4611129Z","eventRecordID":"7308","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.817+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.755518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:09.9498667Z\",\"eventRecordID\":\"10311074\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEDB496A\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xedb496a\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:09.9498667Z","eventRecordID":"10311074","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEDB496A\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xedb496a","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.839+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":5,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.763705","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:10.2612174Z\",\"eventRecordID\":\"10311075\",\"processID\":\"4\",\"threadID\":\"13924\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:10.2612174Z","eventRecordID":"10311075","processID":"4","threadID":"13924","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.857+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":65,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.767133","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:10.2769367Z\",\"eventRecordID\":\"10311076\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:10.2769367Z","eventRecordID":"10311076","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.873+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.767133","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:23:41.9767379Z\",\"eventRecordID\":\"7309\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:23:41.9767379Z","eventRecordID":"7309","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.875+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.767133","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:10.2769525Z\",\"eventRecordID\":\"10311077\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:10.2769525Z","eventRecordID":"10311077","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.905+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":6,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.767133","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:10.2787086Z\",\"eventRecordID\":\"10311078\",\"processID\":\"4\",\"threadID\":\"13924\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:10.2787086Z","eventRecordID":"10311078","processID":"4","threadID":"13924","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.924+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":66,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.778465","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:50.1345656Z\",\"eventRecordID\":\"10311079\",\"processID\":\"416\",\"threadID\":\"19868\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:50.1345656Z","eventRecordID":"10311079","processID":"416","threadID":"19868","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.950+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.778465","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:23:42.0121445Z\",\"eventRecordID\":\"7310\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:23:42.0121445Z","eventRecordID":"7310","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.953+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.778465","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:09:50.1345826Z\",\"eventRecordID\":\"10311080\",\"processID\":\"416\",\"threadID\":\"19868\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:09:50.1345826Z","eventRecordID":"10311080","processID":"416","threadID":"19868","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.972+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":67,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.778465","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:12:01.4842322Z\",\"eventRecordID\":\"10311081\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:12:01.4842322Z","eventRecordID":"10311081","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.986+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.786575","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:12:01.4842665Z\",\"eventRecordID\":\"10311082\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:12:01.4842665Z","eventRecordID":"10311082","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:08.998+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315168.786575","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:23:49.3149443Z\",\"eventRecordID\":\"7311\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:23:49.3149443Z","eventRecordID":"7311","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.015+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":68,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.794683","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:15:08.4629217Z\",\"eventRecordID\":\"10311083\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:15:08.4629217Z","eventRecordID":"10311083","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.043+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.794683","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:15:08.4629418Z\",\"eventRecordID\":\"10311084\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:15:08.4629418Z","eventRecordID":"10311084","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.045+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.794683","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:23:50.5862754Z\",\"eventRecordID\":\"7312\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:23:50.5862754Z","eventRecordID":"7312","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.063+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":69,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.802793","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:15:59.3834256Z\",\"eventRecordID\":\"10311085\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:15:59.3834256Z","eventRecordID":"10311085","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.077+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.802793","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:15:59.3834536Z\",\"eventRecordID\":\"10311086\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:15:59.3834536Z","eventRecordID":"10311086","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.094+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":70,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.810903","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:15:59.3866961Z\",\"eventRecordID\":\"10311087\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:15:59.3866961Z","eventRecordID":"10311087","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.107+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.810903","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:54:10.4454615Z\",\"eventRecordID\":\"7313\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:54:10.4454615Z","eventRecordID":"7313","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.127+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.810903","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:15:59.3867299Z\",\"eventRecordID\":\"10311088\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:15:59.3867299Z","eventRecordID":"10311088","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.145+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":71,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.819013","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:01.3886683Z\",\"eventRecordID\":\"10311089\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:01.3886683Z","eventRecordID":"10311089","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.154+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.819013","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:54:39.9920052Z\",\"eventRecordID\":\"7314\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:54:39.9920052Z","eventRecordID":"7314","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.179+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.819013","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:01.3886847Z\",\"eventRecordID\":\"10311090\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:01.3886847Z","eventRecordID":"10311090","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.194+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":4,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.827123","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:09.1835470Z\",\"eventRecordID\":\"10311091\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEE3BFB4\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xee3bfb4\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:09.1835470Z","eventRecordID":"10311091","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEE3BFB4\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xee3bfb4","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.215+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.827123","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:09.1836029Z\",\"eventRecordID\":\"10311092\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEE3BFB4\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xee3bfb4\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:09.1836029Z","eventRecordID":"10311092","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEE3BFB4\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xee3bfb4","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.219+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.827123","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:54:40.0145714Z\",\"eventRecordID\":\"7315\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:54:40.0145714Z","eventRecordID":"7315","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.227+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":7,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.835312","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:09.5185173Z\",\"eventRecordID\":\"10311093\",\"processID\":\"4\",\"threadID\":\"17228\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:09.5185173Z","eventRecordID":"10311093","processID":"4","threadID":"17228","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.248+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":72,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.838740","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:09.5363618Z\",\"eventRecordID\":\"10311094\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:09.5363618Z","eventRecordID":"10311094","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.261+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.838740","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:09.5363908Z\",\"eventRecordID\":\"10311095\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:09.5363908Z","eventRecordID":"10311095","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.276+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.838740","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:54:47.2953783Z\",\"eventRecordID\":\"7316\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:54:47.2953783Z","eventRecordID":"7316","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.305+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":8,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.846850","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:09.5377680Z\",\"eventRecordID\":\"10311096\",\"processID\":\"4\",\"threadID\":\"17228\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:09.5377680Z","eventRecordID":"10311096","processID":"4","threadID":"17228","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.316+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":5,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.850074","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:37.2593582Z\",\"eventRecordID\":\"10311097\",\"processID\":\"416\",\"threadID\":\"11464\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEEA1FAF\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xeea1faf\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:37.2593582Z","eventRecordID":"10311097","processID":"416","threadID":"11464","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEEA1FAF\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xeea1faf","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.336+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.850074","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T19:54:48.6051104Z\",\"eventRecordID\":\"7317\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T19:54:48.6051104Z","eventRecordID":"7317","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.340+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.850074","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:37.2593788Z\",\"eventRecordID\":\"10311098\",\"processID\":\"416\",\"threadID\":\"11464\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xEEA1FAF\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xeea1faf\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:37.2593788Z","eventRecordID":"10311098","processID":"416","threadID":"11464","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xEEA1FAF\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xeea1faf","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.368+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":9,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.858263","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:37.5740751Z\",\"eventRecordID\":\"10311099\",\"processID\":\"4\",\"threadID\":\"3536\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:37.5740751Z","eventRecordID":"10311099","processID":"4","threadID":"3536","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.371+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":10,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.861689","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:16:37.5872015Z\",\"eventRecordID\":\"10311100\",\"processID\":\"4\",\"threadID\":\"16992\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:16:37.5872015Z","eventRecordID":"10311100","processID":"4","threadID":"16992","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.400+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.861689","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:14:15.0733269Z\",\"eventRecordID\":\"7319\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:14:15.0733269Z","eventRecordID":"7319","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.400+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.861689","full_log":"{\"win\":{\"system\":{\"providerName\":\"gupdate\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:11:45.8233994Z\",\"eventRecordID\":\"7318\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"Service stopped\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"gupdate","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:11:45.8233994Z","eventRecordID":"7318","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"Service stopped"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.418+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":73,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.861689","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:20:40.5431201Z\",\"eventRecordID\":\"10311101\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:20:40.5431201Z","eventRecordID":"10311101","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.431+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":5,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.873021","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:14:45.9639551Z\",\"eventRecordID\":\"7320\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T20:14:45Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-08T20:14:45Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:14:45.9639551Z","eventRecordID":"7320","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T20:14:45Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-08T20:14:45Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.453+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.873021","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:20:40.5431381Z\",\"eventRecordID\":\"10311102\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:20:40.5431381Z","eventRecordID":"10311102","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.474+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.873021","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:25:08.4018253Z\",\"eventRecordID\":\"7321\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:25:08.4018253Z","eventRecordID":"7321","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.482+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":74,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.874604","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:20:42.1334625Z\",\"eventRecordID\":\"10311103\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:20:42.1334625Z","eventRecordID":"10311103","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.505+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.874604","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:20:42.1334775Z\",\"eventRecordID\":\"10311104\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:20:42.1334775Z","eventRecordID":"10311104","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.519+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":75,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.882712","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:22:45.7641922Z\",\"eventRecordID\":\"10311105\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:22:45.7641922Z","eventRecordID":"10311105","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.535+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.882712","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:25:37.9781232Z\",\"eventRecordID\":\"7322\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:25:37.9781232Z","eventRecordID":"7322","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.539+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.882712","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:22:45.7642333Z\",\"eventRecordID\":\"10311106\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:22:45.7642333Z","eventRecordID":"10311106","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.556+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":76,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.890820","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:25:26.3532755Z\",\"eventRecordID\":\"10311107\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:25:26.3532755Z","eventRecordID":"10311107","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.570+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.890820","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:25:26.3532926Z\",\"eventRecordID\":\"10311108\",\"processID\":\"416\",\"threadID\":\"4320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:25:26.3532926Z","eventRecordID":"10311108","processID":"416","threadID":"4320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.580+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.890820","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:25:38.0363975Z\",\"eventRecordID\":\"7323\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:25:38.0363975Z","eventRecordID":"7323","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.611+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":77,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.890820","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:29:25.5586167Z\",\"eventRecordID\":\"10311109\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:29:25.5586167Z","eventRecordID":"10311109","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.630+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.898928","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:29:25.5586353Z\",\"eventRecordID\":\"10311110\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:29:25.5586353Z","eventRecordID":"10311110","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.633+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.898928","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:25:45.2954536Z\",\"eventRecordID\":\"7324\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:25:45.2954536Z","eventRecordID":"7324","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.650+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":78,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.898928","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:29:27.1550816Z\",\"eventRecordID\":\"10311111\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:29:27.1550816Z","eventRecordID":"10311111","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.666+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.907036","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:29:27.1550962Z\",\"eventRecordID\":\"10311112\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:29:27.1550962Z","eventRecordID":"10311112","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.681+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":79,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.915144","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:31:08.3846530Z\",\"eventRecordID\":\"10311113\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:31:08.3846530Z","eventRecordID":"10311113","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.694+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.915144","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:25:46.6031810Z\",\"eventRecordID\":\"7325\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:25:46.6031810Z","eventRecordID":"7325","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.717+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.915144","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:31:08.3846694Z\",\"eventRecordID\":\"10311114\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:31:08.3846694Z","eventRecordID":"10311114","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.731+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":80,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.923252","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:35:15.6711620Z\",\"eventRecordID\":\"10311115\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:35:15.6711620Z","eventRecordID":"10311115","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.744+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.923252","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:56:06.4936587Z\",\"eventRecordID\":\"7326\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:56:06.4936587Z","eventRecordID":"7326","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.766+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.923252","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:35:15.6711999Z\",\"eventRecordID\":\"10311116\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:35:15.6711999Z","eventRecordID":"10311116","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.786+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":81,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.931360","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:39:49.0449777Z\",\"eventRecordID\":\"10311117\",\"processID\":\"416\",\"threadID\":\"1764\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:39:49.0449777Z","eventRecordID":"10311117","processID":"416","threadID":"1764","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.799+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.931360","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:39:49.0450113Z\",\"eventRecordID\":\"10311118\",\"processID\":\"416\",\"threadID\":\"1764\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:39:49.0450113Z","eventRecordID":"10311118","processID":"416","threadID":"1764","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.816+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.931360","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:56:34.9657907Z\",\"eventRecordID\":\"7327\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:56:34.9657907Z","eventRecordID":"7327","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.828+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":82,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.939468","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:44:28.1709123Z\",\"eventRecordID\":\"10311119\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:44:28.1709123Z","eventRecordID":"10311119","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.846+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.939468","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:44:28.1709489Z\",\"eventRecordID\":\"10311120\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:44:28.1709489Z","eventRecordID":"10311120","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.849+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.939468","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:56:35.0148356Z\",\"eventRecordID\":\"7328\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:56:35.0148356Z","eventRecordID":"7328","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.867+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":83,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.947578","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:47:34.8111855Z\",\"eventRecordID\":\"10311121\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:47:34.8111855Z","eventRecordID":"10311121","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.880+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.947578","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:47:34.8112197Z\",\"eventRecordID\":\"10311122\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:47:34.8112197Z","eventRecordID":"10311122","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.897+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":84,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.955686","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:50:09.5296238Z\",\"eventRecordID\":\"10311123\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:50:09.5296238Z","eventRecordID":"10311123","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.910+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.955686","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:56:42.3062182Z\",\"eventRecordID\":\"7329\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:56:42.3062182Z","eventRecordID":"7329","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.931+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.955686","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:50:09.5296582Z\",\"eventRecordID\":\"10311124\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:50:09.5296582Z","eventRecordID":"10311124","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.946+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":85,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.963794","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:52:26.6191266Z\",\"eventRecordID\":\"10311125\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:52:26.6191266Z","eventRecordID":"10311125","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.959+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.963794","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T20:56:43.5910012Z\",\"eventRecordID\":\"7330\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T20:56:43.5910012Z","eventRecordID":"7330","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.980+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.963794","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:52:26.6191427Z\",\"eventRecordID\":\"10311126\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:52:26.6191427Z","eventRecordID":"10311126","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:09.995+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":86,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315169.971904","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:53:44.0771162Z\",\"eventRecordID\":\"10311127\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:53:44.0771162Z","eventRecordID":"10311127","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.016+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.971904","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:53:44.0771514Z\",\"eventRecordID\":\"10311128\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:53:44.0771514Z","eventRecordID":"10311128","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.024+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.971904","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:27:03.4345585Z\",\"eventRecordID\":\"7331\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:27:03.4345585Z","eventRecordID":"7331","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.040+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":87,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.980014","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:04.9282830Z\",\"eventRecordID\":\"10311129\",\"processID\":\"416\",\"threadID\":\"17352\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:04.9282830Z","eventRecordID":"10311129","processID":"416","threadID":"17352","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.058+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.980014","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:04.9283243Z\",\"eventRecordID\":\"10311130\",\"processID\":\"416\",\"threadID\":\"17352\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:04.9283243Z","eventRecordID":"10311130","processID":"416","threadID":"17352","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.069+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.980014","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:27:33.9912758Z\",\"eventRecordID\":\"7332\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:27:33.9912758Z","eventRecordID":"7332","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.084+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":88,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.980014","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:07.1699872Z\",\"eventRecordID\":\"10311131\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:07.1699872Z","eventRecordID":"10311131","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.105+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.988124","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:07.1700031Z\",\"eventRecordID\":\"10311132\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:07.1700031Z","eventRecordID":"10311132","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.119+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":89,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.996234","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:07.5108013Z\",\"eventRecordID\":\"10311133\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:07.5108013Z","eventRecordID":"10311133","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.141+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.996234","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:27:34.0143629Z\",\"eventRecordID\":\"7333\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:27:34.0143629Z","eventRecordID":"7333","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.144+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.996234","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:07.5108171Z\",\"eventRecordID\":\"10311134\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:07.5108171Z","eventRecordID":"10311134","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.162+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":6,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.996234","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:09.9122216Z\",\"eventRecordID\":\"10311135\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF027E26\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf027e26\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:09.9122216Z","eventRecordID":"10311135","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF027E26\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf027e26","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.169+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1004344","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:27:47.5204011Z\",\"eventRecordID\":\"7334\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:27:47.5204011Z","eventRecordID":"7334","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.195+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1004344","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:09.9122443Z\",\"eventRecordID\":\"10311136\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF027E26\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf027e26\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:09.9122443Z","eventRecordID":"10311136","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF027E26\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf027e26","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.209+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":90,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1004344","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:10.9924858Z\",\"eventRecordID\":\"10311137\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:10.9924858Z","eventRecordID":"10311137","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.229+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1012534","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:10.9925023Z\",\"eventRecordID\":\"10311138\",\"processID\":\"416\",\"threadID\":\"17028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:10.9925023Z","eventRecordID":"10311138","processID":"416","threadID":"17028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.238+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1012534","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:27:48.7948392Z\",\"eventRecordID\":\"7335\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:27:48.7948392Z","eventRecordID":"7335","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.266+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":11,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1020645","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:11.1794347Z\",\"eventRecordID\":\"10311139\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:11.1794347Z","eventRecordID":"10311139","processID":"4","threadID":"18772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.268+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1020645","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:27:55.5916237Z\",\"eventRecordID\":\"7336\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:27:55.5916237Z","eventRecordID":"7336","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.297+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":6,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1020645","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:28:27.4509821Z\",\"eventRecordID\":\"7337\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T21:28:27Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-08T21:28:27Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:28:27.4509821Z","eventRecordID":"7337","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T21:28:27Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-08T21:28:27Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.306+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":91,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1025658","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:11.1899941Z\",\"eventRecordID\":\"10311140\",\"processID\":\"416\",\"threadID\":\"13304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:11.1899941Z","eventRecordID":"10311140","processID":"416","threadID":"13304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.328+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1025658","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:11.1900099Z\",\"eventRecordID\":\"10311141\",\"processID\":\"416\",\"threadID\":\"13304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:11.1900099Z","eventRecordID":"10311141","processID":"416","threadID":"13304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.330+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1025658","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:58:02.4203591Z\",\"eventRecordID\":\"7338\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:58:02.4203591Z","eventRecordID":"7338","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.368+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":12,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1025658","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:11.1912603Z\",\"eventRecordID\":\"10311142\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:11.1912603Z","eventRecordID":"10311142","processID":"4","threadID":"18772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.391+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":92,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1036994","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:32.3222336Z\",\"eventRecordID\":\"10311143\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:32.3222336Z","eventRecordID":"10311143","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.413+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1036994","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:58:30.9691398Z\",\"eventRecordID\":\"7339\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:58:30.9691398Z","eventRecordID":"7339","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.416+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1036994","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T13:56:32.3222492Z\",\"eventRecordID\":\"10311144\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T13:56:32.3222492Z","eventRecordID":"10311144","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.515+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1036994","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:58:31.0134874Z\",\"eventRecordID\":\"7340\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:58:31.0134874Z","eventRecordID":"7340","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.516+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1045103","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:58:38.3540714Z\",\"eventRecordID\":\"7341\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:58:38.3540714Z","eventRecordID":"7341","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.515+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1045103","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:00:15.3880930Z\",\"eventRecordID\":\"10311146\",\"processID\":\"416\",\"threadID\":\"20424\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:00:15.3880930Z","eventRecordID":"10311146","processID":"416","threadID":"20424","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.515+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":93,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1045103","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:00:15.3880767Z\",\"eventRecordID\":\"10311145\",\"processID\":\"416\",\"threadID\":\"20424\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:00:15.3880767Z","eventRecordID":"10311145","processID":"416","threadID":"20424","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.516+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1045103","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:06:13.7845540Z\",\"eventRecordID\":\"10311148\",\"processID\":\"416\",\"threadID\":\"19236\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:06:13.7845540Z","eventRecordID":"10311148","processID":"416","threadID":"19236","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.516+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":94,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1053214","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:06:13.7845370Z\",\"eventRecordID\":\"10311147\",\"processID\":\"416\",\"threadID\":\"19236\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:06:13.7845370Z","eventRecordID":"10311147","processID":"416","threadID":"19236","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.530+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":95,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1053214","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:11:56.7966938Z\",\"eventRecordID\":\"10311149\",\"processID\":\"416\",\"threadID\":\"15828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:11:56.7966938Z","eventRecordID":"10311149","processID":"416","threadID":"15828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.547+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1061325","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:11:56.7967283Z\",\"eventRecordID\":\"10311150\",\"processID\":\"416\",\"threadID\":\"15828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:11:56.7967283Z","eventRecordID":"10311150","processID":"416","threadID":"15828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.563+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":96,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1069436","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:14:11.6826868Z\",\"eventRecordID\":\"10311151\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:14:11.6826868Z","eventRecordID":"10311151","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.567+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1069436","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T21:58:39.6253575Z\",\"eventRecordID\":\"7342\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T21:58:39.6253575Z","eventRecordID":"7342","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.581+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1069436","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:14:11.6827209Z\",\"eventRecordID\":\"10311152\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:14:11.6827209Z","eventRecordID":"10311152","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.599+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":97,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1077545","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:18:00.0904540Z\",\"eventRecordID\":\"10311153\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:18:00.0904540Z","eventRecordID":"10311153","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.621+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1077545","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:18:00.0904702Z\",\"eventRecordID\":\"10311154\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:18:00.0904702Z","eventRecordID":"10311154","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.631+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1077545","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:28:59.4846988Z\",\"eventRecordID\":\"7343\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:28:59.4846988Z","eventRecordID":"7343","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.650+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":98,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1077545","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:00.9437106Z\",\"eventRecordID\":\"10311155\",\"processID\":\"416\",\"threadID\":\"15656\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:00.9437106Z","eventRecordID":"10311155","processID":"416","threadID":"15656","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.673+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1085654","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:00.9437349Z\",\"eventRecordID\":\"10311156\",\"processID\":\"416\",\"threadID\":\"15656\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:00.9437349Z","eventRecordID":"10311156","processID":"416","threadID":"15656","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.676+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1085654","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:29:28.9901766Z\",\"eventRecordID\":\"7344\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:29:28.9901766Z","eventRecordID":"7344","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.694+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":99,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1093765","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:03.1703039Z\",\"eventRecordID\":\"10311157\",\"processID\":\"416\",\"threadID\":\"15656\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:03.1703039Z","eventRecordID":"10311157","processID":"416","threadID":"15656","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.710+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1093765","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:03.1703194Z\",\"eventRecordID\":\"10311158\",\"processID\":\"416\",\"threadID\":\"15656\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:03.1703194Z","eventRecordID":"10311158","processID":"416","threadID":"15656","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.725+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":100,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1101876","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:03.5176161Z\",\"eventRecordID\":\"10311159\",\"processID\":\"416\",\"threadID\":\"15656\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:03.5176161Z","eventRecordID":"10311159","processID":"416","threadID":"15656","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.742+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1101876","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:29:29.0289119Z\",\"eventRecordID\":\"7345\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:29:29.0289119Z","eventRecordID":"7345","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.759+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1101876","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:03.5176482Z\",\"eventRecordID\":\"10311160\",\"processID\":\"416\",\"threadID\":\"15656\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:03.5176482Z","eventRecordID":"10311160","processID":"416","threadID":"15656","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.774+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":7,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1109987","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:05.9195980Z\",\"eventRecordID\":\"10311161\",\"processID\":\"416\",\"threadID\":\"2596\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF11C215\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf11c215\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:05.9195980Z","eventRecordID":"10311161","processID":"416","threadID":"2596","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF11C215\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf11c215","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.795+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1109987","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:29:36.2806756Z\",\"eventRecordID\":\"7346\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:29:36.2806756Z","eventRecordID":"7346","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.803+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1109987","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:05.9196201Z\",\"eventRecordID\":\"10311162\",\"processID\":\"416\",\"threadID\":\"2596\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF11C215\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf11c215\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:05.9196201Z","eventRecordID":"10311162","processID":"416","threadID":"2596","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF11C215\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf11c215","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.819+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":101,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1109987","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:06.9961513Z\",\"eventRecordID\":\"10311163\",\"processID\":\"416\",\"threadID\":\"2596\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:06.9961513Z","eventRecordID":"10311163","processID":"416","threadID":"2596","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.830+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1118175","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:06.9961687Z\",\"eventRecordID\":\"10311164\",\"processID\":\"416\",\"threadID\":\"2596\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:06.9961687Z","eventRecordID":"10311164","processID":"416","threadID":"2596","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.846+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1118175","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:29:37.5651736Z\",\"eventRecordID\":\"7347\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:29:37.5651736Z","eventRecordID":"7347","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.862+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":13,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1126284","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:07.2265328Z\",\"eventRecordID\":\"10311165\",\"processID\":\"4\",\"threadID\":\"14564\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:07.2265328Z","eventRecordID":"10311165","processID":"4","threadID":"14564","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.882+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":102,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1129713","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:07.2394406Z\",\"eventRecordID\":\"10311166\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:07.2394406Z","eventRecordID":"10311166","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.896+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1129713","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:07.2394561Z\",\"eventRecordID\":\"10311167\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:07.2394561Z","eventRecordID":"10311167","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.910+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1129713","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:31:15.0775400Z\",\"eventRecordID\":\"7348\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionDisconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:31:15.0775400Z","eventRecordID":"7348","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionDisconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.928+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":14,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1137822","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:07.2409737Z\",\"eventRecordID\":\"10311168\",\"processID\":\"4\",\"threadID\":\"12764\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:07.2409737Z","eventRecordID":"10311168","processID":"4","threadID":"12764","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.939+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1137822","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:53:40.1191424Z\",\"eventRecordID\":\"7349\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:53:40.1191424Z","eventRecordID":"7349","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.959+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":7,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1137822","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T22:54:10.4754278Z\",\"eventRecordID\":\"7350\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T22:54:10Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-08T22:54:10Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T22:54:10.4754278Z","eventRecordID":"7350","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-08T22:54:10Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-08T22:54:10Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.975+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":103,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1142631","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:28.4475495Z\",\"eventRecordID\":\"10311169\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:28.4475495Z","eventRecordID":"10311169","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:10.996+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315170.1142631","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:27:28.4475653Z\",\"eventRecordID\":\"10311170\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:27:28.4475653Z","eventRecordID":"10311170","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.003+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1142631","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-02T23:01:57.4967121Z\",\"eventRecordID\":\"7351\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMSUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-02T23:01:57.4967121Z","eventRecordID":"7351","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMSUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.022+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":104,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1142631","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:30:52.2342834Z\",\"eventRecordID\":\"10311171\",\"processID\":\"416\",\"threadID\":\"17616\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:30:52.2342834Z","eventRecordID":"10311171","processID":"416","threadID":"17616","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.040+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1150740","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:30:52.2343255Z\",\"eventRecordID\":\"10311172\",\"processID\":\"416\",\"threadID\":\"17616\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:30:52.2343255Z","eventRecordID":"10311172","processID":"416","threadID":"17616","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.048+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1150740","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:24:47.1953818Z\",\"eventRecordID\":\"7352\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMESUSPEND\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:24:47.1953818Z","eventRecordID":"7352","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMESUSPEND"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.068+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":105,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1158851","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:31:11.4836324Z\",\"eventRecordID\":\"10311173\",\"processID\":\"416\",\"threadID\":\"17616\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:31:11.4836324Z","eventRecordID":"10311173","processID":"416","threadID":"17616","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.082+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1158851","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:31:11.4836490Z\",\"eventRecordID\":\"10311174\",\"processID\":\"416\",\"threadID\":\"17616\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:31:11.4836490Z","eventRecordID":"10311174","processID":"416","threadID":"17616","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.099+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":106,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1166962","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:33:10.2352569Z\",\"eventRecordID\":\"10311175\",\"processID\":\"416\",\"threadID\":\"3856\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:33:10.2352569Z","eventRecordID":"10311175","processID":"416","threadID":"3856","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.110+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1166962","full_log":"{\"win\":{\"system\":{\"providerName\":\"AMPWatchDog\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:24:47.2523420Z\",\"eventRecordID\":\"7353\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"AMPWatchDog, PBT_APMRESUMEAUTOMATIC\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AMPWatchDog","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:24:47.2523420Z","eventRecordID":"7353","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"AMPWatchDog, PBT_APMRESUMEAUTOMATIC"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.128+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1166962","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:24:49.3821844Z\",\"eventRecordID\":\"7354\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:24:49.3821844Z","eventRecordID":"7354","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.144+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1166962","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:33:10.2352960Z\",\"eventRecordID\":\"10311176\",\"processID\":\"416\",\"threadID\":\"3856\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:33:10.2352960Z","eventRecordID":"10311176","processID":"416","threadID":"3856","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.163+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":107,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1175071","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:35:56.0579806Z\",\"eventRecordID\":\"10311177\",\"processID\":\"416\",\"threadID\":\"3856\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:35:56.0579806Z","eventRecordID":"10311177","processID":"416","threadID":"3856","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.172+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1175071","full_log":"{\"win\":{\"system\":{\"providerName\":\"igfxCUIService1.0.0.0\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:24:59.5679583Z\",\"eventRecordID\":\"7355\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\" SessionReconnect: 1\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"igfxCUIService1.0.0.0","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:24:59.5679583Z","eventRecordID":"7355","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":" SessionReconnect: 1"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.197+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1175071","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:35:56.0580142Z\",\"eventRecordID\":\"10311178\",\"processID\":\"416\",\"threadID\":\"3856\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:35:56.0580142Z","eventRecordID":"10311178","processID":"416","threadID":"3856","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.236+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1175071","full_log":"{\"win\":{\"system\":{\"providerName\":\"edgeupdate\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:25:10.9728690Z\",\"eventRecordID\":\"7356\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Service stopped.\\\"\"},\"eventdata\":{\"data\":\"Service stopped\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"edgeupdate","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:25:10.9728690Z","eventRecordID":"7356","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Service stopped.\""},"eventdata":{"data":"Service stopped"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.236+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":8,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1183180","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:25:19.6929313Z\",\"eventRecordID\":\"7357\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-12T08:25:19Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-12T08:25:19Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:25:19.6929313Z","eventRecordID":"7357","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-12T08:25:19Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-12T08:25:19Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.251+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":108,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1184764","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:37:09.7604493Z\",\"eventRecordID\":\"10311179\",\"processID\":\"416\",\"threadID\":\"10812\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:37:09.7604493Z","eventRecordID":"10311179","processID":"416","threadID":"10812","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.270+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1184764","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:37:09.7604741Z\",\"eventRecordID\":\"10311180\",\"processID\":\"416\",\"threadID\":\"10812\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:37:09.7604741Z","eventRecordID":"10311180","processID":"416","threadID":"10812","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.288+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1184764","full_log":"{\"win\":{\"system\":{\"providerName\":\"gupdate\",\"eventID\":\"0\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:25:29.6999558Z\",\"eventRecordID\":\"7358\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\"},\"eventdata\":{\"data\":\"Service stopped\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"gupdate","eventID":"0","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:25:29.6999558Z","eventRecordID":"7358","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION"},"eventdata":{"data":"Service stopped"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.288+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":109,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1192875","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:37:09.8714341Z\",\"eventRecordID\":\"10311181\",\"processID\":\"416\",\"threadID\":\"10812\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:37:09.8714341Z","eventRecordID":"10311181","processID":"416","threadID":"10812","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.315+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1192875","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:37:09.8714581Z\",\"eventRecordID\":\"10311182\",\"processID\":\"416\",\"threadID\":\"10812\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:37:09.8714581Z","eventRecordID":"10311182","processID":"416","threadID":"10812","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.329+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":110,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1200986","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:42:53.9384872Z\",\"eventRecordID\":\"10311183\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:42:53.9384872Z","eventRecordID":"10311183","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.347+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1200986","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:42:53.9385208Z\",\"eventRecordID\":\"10311184\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:42:53.9385208Z","eventRecordID":"10311184","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.361+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":111,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1209095","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:53:02.3585446Z\",\"eventRecordID\":\"10311185\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:53:02.3585446Z","eventRecordID":"10311185","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.374+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1209095","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:53:02.3585782Z\",\"eventRecordID\":\"10311186\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:53:02.3585782Z","eventRecordID":"10311186","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.387+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":112,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1217204","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:57:14.3068773Z\",\"eventRecordID\":\"10311187\",\"processID\":\"416\",\"threadID\":\"7204\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:57:14.3068773Z","eventRecordID":"10311187","processID":"416","threadID":"7204","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.397+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1217204","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:57:14.3068929Z\",\"eventRecordID\":\"10311188\",\"processID\":\"416\",\"threadID\":\"7204\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:57:14.3068929Z","eventRecordID":"10311188","processID":"416","threadID":"7204","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.415+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":113,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1225313","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:57:55.0146862Z\",\"eventRecordID\":\"10311189\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:57:55.0146862Z","eventRecordID":"10311189","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.431+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1225313","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:57:55.0147209Z\",\"eventRecordID\":\"10311190\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:57:55.0147209Z","eventRecordID":"10311190","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.447+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":114,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1233424","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:29.9419840Z\",\"eventRecordID\":\"10311191\",\"processID\":\"416\",\"threadID\":\"15936\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:29.9419840Z","eventRecordID":"10311191","processID":"416","threadID":"15936","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.465+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1233424","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:29.9420079Z\",\"eventRecordID\":\"10311192\",\"processID\":\"416\",\"threadID\":\"15936\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:29.9420079Z","eventRecordID":"10311192","processID":"416","threadID":"15936","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.481+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":115,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1233424","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:32.1869247Z\",\"eventRecordID\":\"10311193\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:32.1869247Z","eventRecordID":"10311193","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.499+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1241535","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:32.1869409Z\",\"eventRecordID\":\"10311194\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:32.1869409Z","eventRecordID":"10311194","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.514+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":116,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1249646","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:32.5145898Z\",\"eventRecordID\":\"10311195\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:32.5145898Z","eventRecordID":"10311195","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.534+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1249646","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:32.5146053Z\",\"eventRecordID\":\"10311196\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:32.5146053Z","eventRecordID":"10311196","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.549+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":8,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1249646","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:34.9205935Z\",\"eventRecordID\":\"10311197\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF22A616\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf22a616\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:34.9205935Z","eventRecordID":"10311197","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF22A616\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf22a616","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.561+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1257757","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:34.9206145Z\",\"eventRecordID\":\"10311198\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF22A616\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf22a616\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:34.9206145Z","eventRecordID":"10311198","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF22A616\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf22a616","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.577+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":117,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1265947","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:35.0135457Z\",\"eventRecordID\":\"10311199\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:35.0135457Z","eventRecordID":"10311199","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.596+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1265947","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:35.0135622Z\",\"eventRecordID\":\"10311200\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:35.0135622Z","eventRecordID":"10311200","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.608+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":15,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1274058","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:36.1518382Z\",\"eventRecordID\":\"10311201\",\"processID\":\"4\",\"threadID\":\"17788\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:36.1518382Z","eventRecordID":"10311201","processID":"4","threadID":"17788","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.623+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":118,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1277487","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:36.1637965Z\",\"eventRecordID\":\"10311202\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:36.1637965Z","eventRecordID":"10311202","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.642+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1277487","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:36.1638129Z\",\"eventRecordID\":\"10311203\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:36.1638129Z","eventRecordID":"10311203","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.657+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":16,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1285596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:36.1653980Z\",\"eventRecordID\":\"10311204\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:36.1653980Z","eventRecordID":"10311204","processID":"4","threadID":"18772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.670+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":119,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1288821","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:57.4512714Z\",\"eventRecordID\":\"10311205\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:57.4512714Z","eventRecordID":"10311205","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.704+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1288821","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T14:59:57.4512886Z\",\"eventRecordID\":\"10311206\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T14:59:57.4512886Z","eventRecordID":"10311206","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.720+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":120,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1296930","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:02:01.4555597Z\",\"eventRecordID\":\"10311207\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:02:01.4555597Z","eventRecordID":"10311207","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.746+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1296930","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:02:01.4555997Z\",\"eventRecordID\":\"10311208\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:02:01.4555997Z","eventRecordID":"10311208","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.762+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":121,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1305041","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:03:40.3804721Z\",\"eventRecordID\":\"10311209\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:03:40.3804721Z","eventRecordID":"10311209","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.780+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1305041","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:03:40.3804889Z\",\"eventRecordID\":\"10311210\",\"processID\":\"416\",\"threadID\":\"19064\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:03:40.3804889Z","eventRecordID":"10311210","processID":"416","threadID":"19064","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.793+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":122,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1313152","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:38.7691739Z\",\"eventRecordID\":\"10311211\",\"processID\":\"416\",\"threadID\":\"17772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:38.7691739Z","eventRecordID":"10311211","processID":"416","threadID":"17772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.803+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1313152","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:38.7692092Z\",\"eventRecordID\":\"10311212\",\"processID\":\"416\",\"threadID\":\"17772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:38.7692092Z","eventRecordID":"10311212","processID":"416","threadID":"17772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.821+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":123,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1321263","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.0148493Z\",\"eventRecordID\":\"10311213\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.0148493Z","eventRecordID":"10311213","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.831+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1321263","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.0148777Z\",\"eventRecordID\":\"10311214\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.0148777Z","eventRecordID":"10311214","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.846+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":124,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.2798370Z\",\"eventRecordID\":\"10311215\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.2798370Z","eventRecordID":"10311215","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.856+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.2798618Z\",\"eventRecordID\":\"10311216\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.2798618Z","eventRecordID":"10311216","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.877+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.3856502Z\",\"eventRecordID\":\"10311217\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.3856502Z","eventRecordID":"10311217","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.888+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.3860290Z\",\"eventRecordID\":\"10311218\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.3860290Z","eventRecordID":"10311218","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.908+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.3861347Z\",\"eventRecordID\":\"10311219\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:target=virtualapp/didlogical\",\"type\":\"0\",\"countOfCredentialsReturned\":\"1\",\"readOperation\":\"%%8100\",\"returnCode\":\"0\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.3861347Z","eventRecordID":"10311219","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:target=virtualapp/didlogical","type":"0","countOfCredentialsReturned":"1","readOperation":"%%8100","returnCode":"0","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.931+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.3897460Z\",\"eventRecordID\":\"10311220\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.3897460Z","eventRecordID":"10311220","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.934+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.3898730Z\",\"eventRecordID\":\"10311221\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.3898730Z","eventRecordID":"10311221","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.962+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.3903374Z\",\"eventRecordID\":\"10311222\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.3903374Z","eventRecordID":"10311222","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.966+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.4214192Z\",\"eventRecordID\":\"10311223\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.4214192Z","eventRecordID":"10311223","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.995+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.4219766Z\",\"eventRecordID\":\"10311224\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.4219766Z","eventRecordID":"10311224","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:11.998+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315171.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.4221124Z\",\"eventRecordID\":\"10311225\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:target=virtualapp/didlogical\",\"type\":\"0\",\"countOfCredentialsReturned\":\"1\",\"readOperation\":\"%%8100\",\"returnCode\":\"0\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.4221124Z","eventRecordID":"10311225","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:target=virtualapp/didlogical","type":"0","countOfCredentialsReturned":"1","readOperation":"%%8100","returnCode":"0","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.015+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":125,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1329374","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.7794084Z\",\"eventRecordID\":\"10311226\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.7794084Z","eventRecordID":"10311226","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.033+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1337485","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:40.7794280Z\",\"eventRecordID\":\"10311227\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:40.7794280Z","eventRecordID":"10311227","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.045+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1337485","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.0033903Z\",\"eventRecordID\":\"10311228\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.0033903Z","eventRecordID":"10311228","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.067+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1337485","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.0054369Z\",\"eventRecordID\":\"10311229\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.0054369Z","eventRecordID":"10311229","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.082+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1337485","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.0085672Z\",\"eventRecordID\":\"10311230\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.0085672Z","eventRecordID":"10311230","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.102+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1337485","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.0086874Z\",\"eventRecordID\":\"10311231\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.0086874Z","eventRecordID":"10311231","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.114+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":126,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.0129094Z\",\"eventRecordID\":\"10311232\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.0129094Z","eventRecordID":"10311232","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.134+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.0129338Z\",\"eventRecordID\":\"10311233\",\"processID\":\"416\",\"threadID\":\"20112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.0129338Z","eventRecordID":"10311233","processID":"416","threadID":"20112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.142+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.6944381Z\",\"eventRecordID\":\"10311234\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.6944381Z","eventRecordID":"10311234","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.169+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.6945412Z\",\"eventRecordID\":\"10311235\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.6945412Z","eventRecordID":"10311235","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.174+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:41.6950767Z\",\"eventRecordID\":\"10311236\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:41.6950767Z","eventRecordID":"10311236","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.198+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:42.0893334Z\",\"eventRecordID\":\"10311237\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:42.0893334Z","eventRecordID":"10311237","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.202+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:42.0957700Z\",\"eventRecordID\":\"10311238\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:42.0957700Z","eventRecordID":"10311238","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.231+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:42.1012497Z\",\"eventRecordID\":\"10311239\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:42.1012497Z","eventRecordID":"10311239","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.236+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:42.1013575Z\",\"eventRecordID\":\"10311240\",\"processID\":\"416\",\"threadID\":\"17772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-02T15:09:40.2819517Z\",\"clientProcessId\":\"18236\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:42.1013575Z","eventRecordID":"10311240","processID":"416","threadID":"17772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-02T15:09:40.2819517Z","clientProcessId":"18236"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.251+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":127,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1345596","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:56.1110807Z\",\"eventRecordID\":\"10311241\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:56.1110807Z","eventRecordID":"10311241","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.269+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1353707","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:09:56.1110958Z\",\"eventRecordID\":\"10311242\",\"processID\":\"416\",\"threadID\":\"10872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:09:56.1110958Z","eventRecordID":"10311242","processID":"416","threadID":"10872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.285+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":128,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1361818","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:11:03.0808759Z\",\"eventRecordID\":\"10311243\",\"processID\":\"416\",\"threadID\":\"17772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:11:03.0808759Z","eventRecordID":"10311243","processID":"416","threadID":"17772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.306+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1361818","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:11:03.0808917Z\",\"eventRecordID\":\"10311244\",\"processID\":\"416\",\"threadID\":\"17772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:11:03.0808917Z","eventRecordID":"10311244","processID":"416","threadID":"17772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.315+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1361818","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:11:03.4385089Z\",\"eventRecordID\":\"10311245\",\"processID\":\"416\",\"threadID\":\"17772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-544\\r\\n\\tNazwa grupy:\\t\\tAdministratorzy\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x207c\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administratorzy\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-544\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x207c\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:11:03.4385089Z","eventRecordID":"10311245","processID":"416","threadID":"17772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-544\r\n\tNazwa grupy:\t\tAdministratorzy\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x207c\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Administratorzy","targetDomainName":"Builtin","targetSid":"S-1-5-32-544","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x207c","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.337+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1361818","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:11:03.4396318Z\",\"eventRecordID\":\"10311246\",\"processID\":\"416\",\"threadID\":\"17772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-551\\r\\n\\tNazwa grupy:\\t\\tOperatorzy kopii zapasowych\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x207c\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Operatorzy kopii zapasowych\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-551\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x207c\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:11:03.4396318Z","eventRecordID":"10311246","processID":"416","threadID":"17772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-551\r\n\tNazwa grupy:\t\tOperatorzy kopii zapasowych\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x207c\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Operatorzy kopii zapasowych","targetDomainName":"Builtin","targetSid":"S-1-5-32-551","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x207c","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.351+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":129,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1369929","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:14:37.8761955Z\",\"eventRecordID\":\"10311247\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:14:37.8761955Z","eventRecordID":"10311247","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.372+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1369929","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:14:37.8762107Z\",\"eventRecordID\":\"10311248\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:14:37.8762107Z","eventRecordID":"10311248","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.386+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":130,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1378038","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:15:58.0879089Z\",\"eventRecordID\":\"10311249\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:15:58.0879089Z","eventRecordID":"10311249","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.404+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1378038","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:15:58.0879450Z\",\"eventRecordID\":\"10311250\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:15:58.0879450Z","eventRecordID":"10311250","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.420+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":131,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1386147","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:15:58.1395379Z\",\"eventRecordID\":\"10311251\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:15:58.1395379Z","eventRecordID":"10311251","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.438+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1386147","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:15:58.1395538Z\",\"eventRecordID\":\"10311252\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:15:58.1395538Z","eventRecordID":"10311252","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.478+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":132,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1386147","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:15:58.2329562Z\",\"eventRecordID\":\"10311253\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:15:58.2329562Z","eventRecordID":"10311253","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.505+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1394256","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:15:58.2329717Z\",\"eventRecordID\":\"10311254\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:15:58.2329717Z","eventRecordID":"10311254","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.520+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":133,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1402365","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:18:36.8084244Z\",\"eventRecordID\":\"10311255\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:18:36.8084244Z","eventRecordID":"10311255","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.532+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1402365","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:18:36.8084413Z\",\"eventRecordID\":\"10311256\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:18:36.8084413Z","eventRecordID":"10311256","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.547+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":134,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1410474","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:18:38.5119034Z\",\"eventRecordID\":\"10311257\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:18:38.5119034Z","eventRecordID":"10311257","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.563+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1410474","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:18:38.5119185Z\",\"eventRecordID\":\"10311258\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:18:38.5119185Z","eventRecordID":"10311258","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.578+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":135,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1418583","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:19:01.5662611Z\",\"eventRecordID\":\"10311259\",\"processID\":\"416\",\"threadID\":\"17740\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:19:01.5662611Z","eventRecordID":"10311259","processID":"416","threadID":"17740","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.590+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1418583","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:19:01.5662768Z\",\"eventRecordID\":\"10311260\",\"processID\":\"416\",\"threadID\":\"17740\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:19:01.5662768Z","eventRecordID":"10311260","processID":"416","threadID":"17740","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.604+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":136,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1418583","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:28:29.5446718Z\",\"eventRecordID\":\"10311261\",\"processID\":\"416\",\"threadID\":\"17740\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:28:29.5446718Z","eventRecordID":"10311261","processID":"416","threadID":"17740","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.617+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1426694","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:28:29.5447249Z\",\"eventRecordID\":\"10311262\",\"processID\":\"416\",\"threadID\":\"17740\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:28:29.5447249Z","eventRecordID":"10311262","processID":"416","threadID":"17740","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.632+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":137,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1434805","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:32:58.8038517Z\",\"eventRecordID\":\"10311263\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:32:58.8038517Z","eventRecordID":"10311263","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.643+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1434805","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:32:58.8038853Z\",\"eventRecordID\":\"10311264\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:32:58.8038853Z","eventRecordID":"10311264","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.658+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":138,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1442914","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:40:19.8475483Z\",\"eventRecordID\":\"10311265\",\"processID\":\"416\",\"threadID\":\"16148\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:40:19.8475483Z","eventRecordID":"10311265","processID":"416","threadID":"16148","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.668+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1442914","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:40:19.8475817Z\",\"eventRecordID\":\"10311266\",\"processID\":\"416\",\"threadID\":\"16148\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:40:19.8475817Z","eventRecordID":"10311266","processID":"416","threadID":"16148","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.688+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":139,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1451025","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:41:11.2075390Z\",\"eventRecordID\":\"10311267\",\"processID\":\"416\",\"threadID\":\"16148\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:41:11.2075390Z","eventRecordID":"10311267","processID":"416","threadID":"16148","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.700+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1451025","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:41:11.2075721Z\",\"eventRecordID\":\"10311268\",\"processID\":\"416\",\"threadID\":\"16148\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:41:11.2075721Z","eventRecordID":"10311268","processID":"416","threadID":"16148","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.716+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":140,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1459136","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:41:11.2502067Z\",\"eventRecordID\":\"10311269\",\"processID\":\"416\",\"threadID\":\"16148\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:41:11.2502067Z","eventRecordID":"10311269","processID":"416","threadID":"16148","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.725+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1459136","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:41:11.2502600Z\",\"eventRecordID\":\"10311270\",\"processID\":\"416\",\"threadID\":\"16148\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:41:11.2502600Z","eventRecordID":"10311270","processID":"416","threadID":"16148","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.742+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":141,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1467247","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:27.9319293Z\",\"eventRecordID\":\"10311271\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:27.9319293Z","eventRecordID":"10311271","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.761+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1467247","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:27.9319539Z\",\"eventRecordID\":\"10311272\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:27.9319539Z","eventRecordID":"10311272","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.776+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":142,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1467247","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:30.1788459Z\",\"eventRecordID\":\"10311273\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:30.1788459Z","eventRecordID":"10311273","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.796+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1475358","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:30.1788606Z\",\"eventRecordID\":\"10311274\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:30.1788606Z","eventRecordID":"10311274","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.835+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":143,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1483469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:30.5197285Z\",\"eventRecordID\":\"10311275\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:30.5197285Z","eventRecordID":"10311275","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.879+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1483469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:30.5197523Z\",\"eventRecordID\":\"10311276\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:30.5197523Z","eventRecordID":"10311276","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.894+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":144,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1483469","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:31.8499540Z\",\"eventRecordID\":\"10311277\",\"processID\":\"416\",\"threadID\":\"10232\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:31.8499540Z","eventRecordID":"10311277","processID":"416","threadID":"10232","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.908+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1491580","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:31.8499703Z\",\"eventRecordID\":\"10311278\",\"processID\":\"416\",\"threadID\":\"10232\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:31.8499703Z","eventRecordID":"10311278","processID":"416","threadID":"10232","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.919+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":9,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1499691","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:33.0590514Z\",\"eventRecordID\":\"10311279\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF40299E\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf40299e\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:33.0590514Z","eventRecordID":"10311279","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF40299E\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf40299e","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.931+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1499691","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:33.0590742Z\",\"eventRecordID\":\"10311280\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF40299E\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf40299e\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:33.0590742Z","eventRecordID":"10311280","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF40299E\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf40299e","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.945+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":17,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1507881","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:34.2229268Z\",\"eventRecordID\":\"10311281\",\"processID\":\"4\",\"threadID\":\"9032\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:34.2229268Z","eventRecordID":"10311281","processID":"4","threadID":"9032","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.958+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":145,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1511308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:34.2337754Z\",\"eventRecordID\":\"10311282\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:34.2337754Z","eventRecordID":"10311282","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.970+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1511308","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:34.2337988Z\",\"eventRecordID\":\"10311283\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:34.2337988Z","eventRecordID":"10311283","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:12.998+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":18,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315172.1519419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:45:34.2355515Z\",\"eventRecordID\":\"10311284\",\"processID\":\"4\",\"threadID\":\"18772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:45:34.2355515Z","eventRecordID":"10311284","processID":"4","threadID":"18772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.014+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":146,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1522644","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:49:38.4366288Z\",\"eventRecordID\":\"10311285\",\"processID\":\"416\",\"threadID\":\"18708\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:49:38.4366288Z","eventRecordID":"10311285","processID":"416","threadID":"18708","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.024+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1522644","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:49:38.4366529Z\",\"eventRecordID\":\"10311286\",\"processID\":\"416\",\"threadID\":\"18708\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:49:38.4366529Z","eventRecordID":"10311286","processID":"416","threadID":"18708","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.039+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":147,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1522644","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:51:30.5470620Z\",\"eventRecordID\":\"10311287\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:51:30.5470620Z","eventRecordID":"10311287","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.050+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1530755","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:51:30.5470779Z\",\"eventRecordID\":\"10311288\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:51:30.5470779Z","eventRecordID":"10311288","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.066+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":148,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1530755","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:51:34.6027014Z\",\"eventRecordID\":\"10311289\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:51:34.6027014Z","eventRecordID":"10311289","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.077+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1538864","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:51:34.6027274Z\",\"eventRecordID\":\"10311290\",\"processID\":\"416\",\"threadID\":\"16592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:51:34.6027274Z","eventRecordID":"10311290","processID":"416","threadID":"16592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.092+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":149,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1546975","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:51:36.1878602Z\",\"eventRecordID\":\"10311291\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:51:36.1878602Z","eventRecordID":"10311291","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.102+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1546975","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:51:36.1878750Z\",\"eventRecordID\":\"10311292\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:51:36.1878750Z","eventRecordID":"10311292","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.117+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":PC15,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1555084","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:55:36.8650351Z\",\"eventRecordID\":\"10311293\",\"processID\":\"416\",\"threadID\":\"8260\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:55:36.8650351Z","eventRecordID":"10311293","processID":"416","threadID":"8260","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.128+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1555084","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T15:55:36.8650714Z\",\"eventRecordID\":\"10311294\",\"processID\":\"416\",\"threadID\":\"8260\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T15:55:36.8650714Z","eventRecordID":"10311294","processID":"416","threadID":"8260","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.144+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":151,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1555084","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:02:05.9381169Z\",\"eventRecordID\":\"10311295\",\"processID\":\"416\",\"threadID\":\"13636\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:02:05.9381169Z","eventRecordID":"10311295","processID":"416","threadID":"13636","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.158+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1563193","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:02:05.9381325Z\",\"eventRecordID\":\"10311296\",\"processID\":\"416\",\"threadID\":\"13636\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:02:05.9381325Z","eventRecordID":"10311296","processID":"416","threadID":"13636","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.173+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":152,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1571304","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:05:22.8346825Z\",\"eventRecordID\":\"10311297\",\"processID\":\"416\",\"threadID\":\"18664\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:05:22.8346825Z","eventRecordID":"10311297","processID":"416","threadID":"18664","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.184+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1571304","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:05:22.8347275Z\",\"eventRecordID\":\"10311298\",\"processID\":\"416\",\"threadID\":\"18664\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:05:22.8347275Z","eventRecordID":"10311298","processID":"416","threadID":"18664","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.200+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":153,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1571304","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:12:08.0514528Z\",\"eventRecordID\":\"10311299\",\"processID\":\"416\",\"threadID\":\"18664\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:12:08.0514528Z","eventRecordID":"10311299","processID":"416","threadID":"18664","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.277+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1579415","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:12:08.0514865Z\",\"eventRecordID\":\"10311300\",\"processID\":\"416\",\"threadID\":\"18664\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:12:08.0514865Z","eventRecordID":"10311300","processID":"416","threadID":"18664","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.290+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":154,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1587526","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:24.9771567Z\",\"eventRecordID\":\"10311301\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:24.9771567Z","eventRecordID":"10311301","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.301+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1587526","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:24.9771805Z\",\"eventRecordID\":\"10311302\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:24.9771805Z","eventRecordID":"10311302","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.317+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":155,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1587526","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:27.1944681Z\",\"eventRecordID\":\"10311303\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:27.1944681Z","eventRecordID":"10311303","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.328+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1595637","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:27.1944831Z\",\"eventRecordID\":\"10311304\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:27.1944831Z","eventRecordID":"10311304","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.351+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":156,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1603746","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:27.5160588Z\",\"eventRecordID\":\"10311305\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:27.5160588Z","eventRecordID":"10311305","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.353+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1603746","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:27.5160820Z\",\"eventRecordID\":\"10311306\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:27.5160820Z","eventRecordID":"10311306","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.368+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":10,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1611857","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:29.9721163Z\",\"eventRecordID\":\"10311307\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF57246B\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf57246b\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:29.9721163Z","eventRecordID":"10311307","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF57246B\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf57246b","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.379+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1611857","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:29.9721387Z\",\"eventRecordID\":\"10311308\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF57246B\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf57246b\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:29.9721387Z","eventRecordID":"10311308","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF57246B\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf57246b","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.395+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":157,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1611857","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:30.4922605Z\",\"eventRecordID\":\"10311309\",\"processID\":\"416\",\"threadID\":\"8528\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:30.4922605Z","eventRecordID":"10311309","processID":"416","threadID":"8528","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.407+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1620047","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:30.4923080Z\",\"eventRecordID\":\"10311310\",\"processID\":\"416\",\"threadID\":\"8528\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:30.4923080Z","eventRecordID":"10311310","processID":"416","threadID":"8528","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.415+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":19,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1628156","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:31.1886130Z\",\"eventRecordID\":\"10311311\",\"processID\":\"4\",\"threadID\":\"9156\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:31.1886130Z","eventRecordID":"10311311","processID":"4","threadID":"9156","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.430+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":158,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1631583","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:31.2120385Z\",\"eventRecordID\":\"10311312\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:31.2120385Z","eventRecordID":"10311312","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.440+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1631583","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:31.2120541Z\",\"eventRecordID\":\"10311313\",\"processID\":\"416\",\"threadID\":\"15060\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:31.2120541Z","eventRecordID":"10311313","processID":"416","threadID":"15060","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.449+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":20,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1639694","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:31.2132292Z\",\"eventRecordID\":\"10311314\",\"processID\":\"4\",\"threadID\":\"9156\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:31.2132292Z","eventRecordID":"10311314","processID":"4","threadID":"9156","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.464+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":159,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1642917","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:52.3896640Z\",\"eventRecordID\":\"10311315\",\"processID\":\"416\",\"threadID\":\"8528\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:52.3896640Z","eventRecordID":"10311315","processID":"416","threadID":"8528","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.474+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1642917","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:16:52.3896805Z\",\"eventRecordID\":\"10311316\",\"processID\":\"416\",\"threadID\":\"8528\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:16:52.3896805Z","eventRecordID":"10311316","processID":"416","threadID":"8528","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.489+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":160,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1651026","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:20:35.4131631Z\",\"eventRecordID\":\"10311317\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:20:35.4131631Z","eventRecordID":"10311317","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.500+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1651026","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:20:35.4131789Z\",\"eventRecordID\":\"10311318\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:20:35.4131789Z","eventRecordID":"10311318","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.515+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":161,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1651026","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:23:51.2346826Z\",\"eventRecordID\":\"10311319\",\"processID\":\"416\",\"threadID\":\"18664\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:23:51.2346826Z","eventRecordID":"10311319","processID":"416","threadID":"18664","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.530+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1659135","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:23:51.2347201Z\",\"eventRecordID\":\"10311320\",\"processID\":\"416\",\"threadID\":\"18664\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:23:51.2347201Z","eventRecordID":"10311320","processID":"416","threadID":"18664","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.541+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":162,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1667246","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:24:28.8634252Z\",\"eventRecordID\":\"10311321\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:24:28.8634252Z","eventRecordID":"10311321","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.555+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1667246","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:24:28.8634599Z\",\"eventRecordID\":\"10311322\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:24:28.8634599Z","eventRecordID":"10311322","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.571+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":163,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1667246","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:26:33.8169493Z\",\"eventRecordID\":\"10311323\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:26:33.8169493Z","eventRecordID":"10311323","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.581+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1675355","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:26:33.8169842Z\",\"eventRecordID\":\"10311324\",\"processID\":\"416\",\"threadID\":\"12124\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:26:33.8169842Z","eventRecordID":"10311324","processID":"416","threadID":"12124","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.597+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":164,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1683466","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:31:19.9743630Z\",\"eventRecordID\":\"10311325\",\"processID\":\"416\",\"threadID\":\"18112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:31:19.9743630Z","eventRecordID":"10311325","processID":"416","threadID":"18112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.607+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1683466","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:31:19.9743967Z\",\"eventRecordID\":\"10311326\",\"processID\":\"416\",\"threadID\":\"18112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:31:19.9743967Z","eventRecordID":"10311326","processID":"416","threadID":"18112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.622+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":165,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1683466","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:43:05.6604893Z\",\"eventRecordID\":\"10311327\",\"processID\":\"416\",\"threadID\":\"7892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:43:05.6604893Z","eventRecordID":"10311327","processID":"416","threadID":"7892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.633+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1691577","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:43:05.6605234Z\",\"eventRecordID\":\"10311328\",\"processID\":\"416\",\"threadID\":\"7892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:43:05.6605234Z","eventRecordID":"10311328","processID":"416","threadID":"7892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.651+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":166,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1699686","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:45:09.4837194Z\",\"eventRecordID\":\"10311329\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:45:09.4837194Z","eventRecordID":"10311329","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.668+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1699686","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:45:09.4837378Z\",\"eventRecordID\":\"10311330\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:45:09.4837378Z","eventRecordID":"10311330","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.683+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":167,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1699686","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:22.9215788Z\",\"eventRecordID\":\"10311331\",\"processID\":\"416\",\"threadID\":\"7892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:22.9215788Z","eventRecordID":"10311331","processID":"416","threadID":"7892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.717+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1707795","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:22.9216024Z\",\"eventRecordID\":\"10311332\",\"processID\":\"416\",\"threadID\":\"7892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:22.9216024Z","eventRecordID":"10311332","processID":"416","threadID":"7892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.731+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":168,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1715904","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:25.1513871Z\",\"eventRecordID\":\"10311333\",\"processID\":\"416\",\"threadID\":\"11960\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:25.1513871Z","eventRecordID":"10311333","processID":"416","threadID":"11960","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.757+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1715904","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:25.1514024Z\",\"eventRecordID\":\"10311334\",\"processID\":\"416\",\"threadID\":\"11960\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:25.1514024Z","eventRecordID":"10311334","processID":"416","threadID":"11960","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.771+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":169,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1724015","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:25.5029934Z\",\"eventRecordID\":\"10311335\",\"processID\":\"416\",\"threadID\":\"7892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:25.5029934Z","eventRecordID":"10311335","processID":"416","threadID":"7892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.788+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1724015","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:25.5030093Z\",\"eventRecordID\":\"10311336\",\"processID\":\"416\",\"threadID\":\"7892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:25.5030093Z","eventRecordID":"10311336","processID":"416","threadID":"7892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.803+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":170,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1724015","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:27.5328973Z\",\"eventRecordID\":\"10311337\",\"processID\":\"416\",\"threadID\":\"18784\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:27.5328973Z","eventRecordID":"10311337","processID":"416","threadID":"18784","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.817+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1732124","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:27.5329136Z\",\"eventRecordID\":\"10311338\",\"processID\":\"416\",\"threadID\":\"18784\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:27.5329136Z","eventRecordID":"10311338","processID":"416","threadID":"18784","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.833+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":11,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1732124","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:27.9008742Z\",\"eventRecordID\":\"10311339\",\"processID\":\"416\",\"threadID\":\"12872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF66BE85\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf66be85\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:27.9008742Z","eventRecordID":"10311339","processID":"416","threadID":"12872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF66BE85\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf66be85","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.847+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1740235","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:27.9008951Z\",\"eventRecordID\":\"10311340\",\"processID\":\"416\",\"threadID\":\"12872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF66BE85\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf66be85\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:27.9008951Z","eventRecordID":"10311340","processID":"416","threadID":"12872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF66BE85\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf66be85","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.852+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":21,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1748425","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:29.0911522Z\",\"eventRecordID\":\"10311341\",\"processID\":\"4\",\"threadID\":\"18880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:29.0911522Z","eventRecordID":"10311341","processID":"4","threadID":"18880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.872+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":171,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1751854","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:29.1033335Z\",\"eventRecordID\":\"10311342\",\"processID\":\"416\",\"threadID\":\"12872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:29.1033335Z","eventRecordID":"10311342","processID":"416","threadID":"12872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.885+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1751854","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:29.1033500Z\",\"eventRecordID\":\"10311343\",\"processID\":\"416\",\"threadID\":\"12872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:29.1033500Z","eventRecordID":"10311343","processID":"416","threadID":"12872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.898+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":22,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1759965","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:29.1048688Z\",\"eventRecordID\":\"10311344\",\"processID\":\"4\",\"threadID\":\"17732\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:29.1048688Z","eventRecordID":"10311344","processID":"4","threadID":"17732","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.917+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":172,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1759965","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:50.4859635Z\",\"eventRecordID\":\"10311345\",\"processID\":\"416\",\"threadID\":\"12872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:50.4859635Z","eventRecordID":"10311345","processID":"416","threadID":"12872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.945+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1763190","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:47:50.4859801Z\",\"eventRecordID\":\"10311346\",\"processID\":\"416\",\"threadID\":\"12872\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:47:50.4859801Z","eventRecordID":"10311346","processID":"416","threadID":"12872","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.959+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":173,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1771301","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:50:22.2410027Z\",\"eventRecordID\":\"10311347\",\"processID\":\"416\",\"threadID\":\"11960\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:50:22.2410027Z","eventRecordID":"10311347","processID":"416","threadID":"11960","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.975+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1771301","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:50:22.2410414Z\",\"eventRecordID\":\"10311348\",\"processID\":\"416\",\"threadID\":\"11960\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:50:22.2410414Z","eventRecordID":"10311348","processID":"416","threadID":"11960","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:13.990+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":174,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315173.1771301","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:51:33.2747023Z\",\"eventRecordID\":\"10311349\",\"processID\":\"416\",\"threadID\":\"11448\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:51:33.2747023Z","eventRecordID":"10311349","processID":"416","threadID":"11448","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.001+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1779412","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:51:33.2747216Z\",\"eventRecordID\":\"10311350\",\"processID\":\"416\",\"threadID\":\"11448\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:51:33.2747216Z","eventRecordID":"10311350","processID":"416","threadID":"11448","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.016+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":175,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1787523","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:55:31.5222395Z\",\"eventRecordID\":\"10311351\",\"processID\":\"416\",\"threadID\":\"8340\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:55:31.5222395Z","eventRecordID":"10311351","processID":"416","threadID":"8340","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.036+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1787523","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T16:55:31.5222852Z\",\"eventRecordID\":\"10311352\",\"processID\":\"416\",\"threadID\":\"8340\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T16:55:31.5222852Z","eventRecordID":"10311352","processID":"416","threadID":"8340","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.052+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":176,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1787523","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:06:55.8308466Z\",\"eventRecordID\":\"10311353\",\"processID\":\"416\",\"threadID\":\"17452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:06:55.8308466Z","eventRecordID":"10311353","processID":"416","threadID":"17452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.069+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1795632","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:06:55.8308806Z\",\"eventRecordID\":\"10311354\",\"processID\":\"416\",\"threadID\":\"17452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:06:55.8308806Z","eventRecordID":"10311354","processID":"416","threadID":"17452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.083+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":177,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1803743","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:14:04.9453639Z\",\"eventRecordID\":\"10311355\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:14:04.9453639Z","eventRecordID":"10311355","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.101+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1803743","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:14:04.9453975Z\",\"eventRecordID\":\"10311356\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:14:04.9453975Z","eventRecordID":"10311356","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.116+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":178,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1811852","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:21.9235162Z\",\"eventRecordID\":\"10311357\",\"processID\":\"416\",\"threadID\":\"19516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:21.9235162Z","eventRecordID":"10311357","processID":"416","threadID":"19516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.127+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1811852","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:21.9235411Z\",\"eventRecordID\":\"10311358\",\"processID\":\"416\",\"threadID\":\"19516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:21.9235411Z","eventRecordID":"10311358","processID":"416","threadID":"19516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.143+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":179,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1819963","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:24.1397235Z\",\"eventRecordID\":\"10311359\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:24.1397235Z","eventRecordID":"10311359","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.152+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1819963","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:24.1397392Z\",\"eventRecordID\":\"10311360\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:24.1397392Z","eventRecordID":"10311360","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.167+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":180,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1819963","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:24.5104256Z\",\"eventRecordID\":\"10311361\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:24.5104256Z","eventRecordID":"10311361","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.183+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1828072","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:24.5104498Z\",\"eventRecordID\":\"10311362\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:24.5104498Z","eventRecordID":"10311362","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.197+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":12,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1828072","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:26.8898862Z\",\"eventRecordID\":\"10311363\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF75D6ED\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf75d6ed\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:26.8898862Z","eventRecordID":"10311363","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF75D6ED\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf75d6ed","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.208+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1836181","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:26.8899087Z\",\"eventRecordID\":\"10311364\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF75D6ED\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf75d6ed\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:26.8899087Z","eventRecordID":"10311364","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF75D6ED\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf75d6ed","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.228+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":181,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1844369","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:27.0047838Z\",\"eventRecordID\":\"10311365\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:27.0047838Z","eventRecordID":"10311365","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.265+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1844369","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:27.0047996Z\",\"eventRecordID\":\"10311366\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:27.0047996Z","eventRecordID":"10311366","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.267+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":23,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1852478","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:28.1041639Z\",\"eventRecordID\":\"10311367\",\"processID\":\"4\",\"threadID\":\"7808\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:28.1041639Z","eventRecordID":"10311367","processID":"4","threadID":"7808","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.283+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":182,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1855905","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:28.1157915Z\",\"eventRecordID\":\"10311368\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:28.1157915Z","eventRecordID":"10311368","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.300+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1855905","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:28.1158068Z\",\"eventRecordID\":\"10311369\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:28.1158068Z","eventRecordID":"10311369","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.306+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":24,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1855905","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:28.1171731Z\",\"eventRecordID\":\"10311370\",\"processID\":\"4\",\"threadID\":\"17168\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:28.1171731Z","eventRecordID":"10311370","processID":"4","threadID":"17168","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.321+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":183,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1867239","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:49.3486217Z\",\"eventRecordID\":\"10311371\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:49.3486217Z","eventRecordID":"10311371","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.339+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1867239","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:18:49.3486389Z\",\"eventRecordID\":\"10311372\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:18:49.3486389Z","eventRecordID":"10311372","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.355+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":184,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1867239","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:22:32.2999835Z\",\"eventRecordID\":\"10311373\",\"processID\":\"416\",\"threadID\":\"17452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:22:32.2999835Z","eventRecordID":"10311373","processID":"416","threadID":"17452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.380+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1875348","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:22:32.3000004Z\",\"eventRecordID\":\"10311374\",\"processID\":\"416\",\"threadID\":\"17452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:22:32.3000004Z","eventRecordID":"10311374","processID":"416","threadID":"17452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.394+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":185,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1875348","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:22:47.1814034Z\",\"eventRecordID\":\"10311375\",\"processID\":\"416\",\"threadID\":\"17452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:22:47.1814034Z","eventRecordID":"10311375","processID":"416","threadID":"17452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.410+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1883459","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:22:47.1814413Z\",\"eventRecordID\":\"10311376\",\"processID\":\"416\",\"threadID\":\"17452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:22:47.1814413Z","eventRecordID":"10311376","processID":"416","threadID":"17452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.426+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":186,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1883459","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:26:24.6042563Z\",\"eventRecordID\":\"10311377\",\"processID\":\"416\",\"threadID\":\"14108\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:26:24.6042563Z","eventRecordID":"10311377","processID":"416","threadID":"14108","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.436+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1891570","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:26:24.6042947Z\",\"eventRecordID\":\"10311378\",\"processID\":\"416\",\"threadID\":\"14108\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:26:24.6042947Z","eventRecordID":"10311378","processID":"416","threadID":"14108","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.455+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":187,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1891570","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:28:42.8959669Z\",\"eventRecordID\":\"10311379\",\"processID\":\"416\",\"threadID\":\"12424\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:28:42.8959669Z","eventRecordID":"10311379","processID":"416","threadID":"12424","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.476+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1899681","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:28:42.8959844Z\",\"eventRecordID\":\"10311380\",\"processID\":\"416\",\"threadID\":\"12424\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:28:42.8959844Z","eventRecordID":"10311380","processID":"416","threadID":"12424","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.491+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":188,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1899681","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:45:02.1523203Z\",\"eventRecordID\":\"10311381\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:45:02.1523203Z","eventRecordID":"10311381","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.500+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1907792","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:45:02.1523545Z\",\"eventRecordID\":\"10311382\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:45:02.1523545Z","eventRecordID":"10311382","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.511+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":189,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1915901","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:20.9249485Z\",\"eventRecordID\":\"10311383\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:20.9249485Z","eventRecordID":"10311383","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.523+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1915901","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:20.9249728Z\",\"eventRecordID\":\"10311384\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:20.9249728Z","eventRecordID":"10311384","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.539+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":190,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1924012","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:23.1763156Z\",\"eventRecordID\":\"10311385\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:23.1763156Z","eventRecordID":"10311385","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.565+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1924012","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:23.1763302Z\",\"eventRecordID\":\"10311386\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:23.1763302Z","eventRecordID":"10311386","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.580+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":191,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1932123","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:23.5082600Z\",\"eventRecordID\":\"10311387\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:23.5082600Z","eventRecordID":"10311387","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.596+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1932123","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:23.5082890Z\",\"eventRecordID\":\"10311388\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:23.5082890Z","eventRecordID":"10311388","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.610+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":13,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1940234","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:25.8757319Z\",\"eventRecordID\":\"10311389\",\"processID\":\"416\",\"threadID\":\"3668\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF850F10\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf850f10\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:25.8757319Z","eventRecordID":"10311389","processID":"416","threadID":"3668","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF850F10\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf850f10","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.622+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1940234","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:25.8757533Z\",\"eventRecordID\":\"10311390\",\"processID\":\"416\",\"threadID\":\"3668\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF850F10\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf850f10\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:25.8757533Z","eventRecordID":"10311390","processID":"416","threadID":"3668","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF850F10\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf850f10","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.638+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":192,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1940234","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:26.3274568Z\",\"eventRecordID\":\"10311391\",\"processID\":\"416\",\"threadID\":\"356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:26.3274568Z","eventRecordID":"10311391","processID":"416","threadID":"356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.655+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1948422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:26.3274814Z\",\"eventRecordID\":\"10311392\",\"processID\":\"416\",\"threadID\":\"356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:26.3274814Z","eventRecordID":"10311392","processID":"416","threadID":"356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.664+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":25,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1948422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:27.0873321Z\",\"eventRecordID\":\"10311393\",\"processID\":\"4\",\"threadID\":\"13772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:27.0873321Z","eventRecordID":"10311393","processID":"4","threadID":"13772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.681+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":193,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1959958","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:27.1319468Z\",\"eventRecordID\":\"10311394\",\"processID\":\"416\",\"threadID\":\"356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:27.1319468Z","eventRecordID":"10311394","processID":"416","threadID":"356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.705+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1959958","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:27.1319627Z\",\"eventRecordID\":\"10311395\",\"processID\":\"416\",\"threadID\":\"356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:27.1319627Z","eventRecordID":"10311395","processID":"416","threadID":"356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.711+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":26,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1959958","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:27.1334897Z\",\"eventRecordID\":\"10311396\",\"processID\":\"4\",\"threadID\":\"12508\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:27.1334897Z","eventRecordID":"10311396","processID":"4","threadID":"12508","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.743+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":194,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1971290","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:48.4758049Z\",\"eventRecordID\":\"10311397\",\"processID\":\"416\",\"threadID\":\"3668\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:48.4758049Z","eventRecordID":"10311397","processID":"416","threadID":"3668","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.769+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1971290","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:49:48.4758215Z\",\"eventRecordID\":\"10311398\",\"processID\":\"416\",\"threadID\":\"3668\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:49:48.4758215Z","eventRecordID":"10311398","processID":"416","threadID":"3668","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.783+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":195,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1971290","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:50:30.2570636Z\",\"eventRecordID\":\"10311399\",\"processID\":\"416\",\"threadID\":\"2320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:50:30.2570636Z","eventRecordID":"10311399","processID":"416","threadID":"2320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.800+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1979399","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:50:30.2570820Z\",\"eventRecordID\":\"10311400\",\"processID\":\"416\",\"threadID\":\"2320\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:50:30.2570820Z","eventRecordID":"10311400","processID":"416","threadID":"2320","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.815+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":196,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1987508","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:53:31.3147162Z\",\"eventRecordID\":\"10311401\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:53:31.3147162Z","eventRecordID":"10311401","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.831+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1987508","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:53:31.3147329Z\",\"eventRecordID\":\"10311402\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:53:31.3147329Z","eventRecordID":"10311402","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.846+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":197,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1995619","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:53:45.4331799Z\",\"eventRecordID\":\"10311403\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:53:45.4331799Z","eventRecordID":"10311403","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.857+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.1995619","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:53:45.4332141Z\",\"eventRecordID\":\"10311404\",\"processID\":\"416\",\"threadID\":\"19304\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:53:45.4332141Z","eventRecordID":"10311404","processID":"416","threadID":"19304","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.872+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":198,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2003730","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:57:24.5285205Z\",\"eventRecordID\":\"10311405\",\"processID\":\"416\",\"threadID\":\"356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:57:24.5285205Z","eventRecordID":"10311405","processID":"416","threadID":"356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.885+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2003730","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:57:24.5285592Z\",\"eventRecordID\":\"10311406\",\"processID\":\"416\",\"threadID\":\"356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:57:24.5285592Z","eventRecordID":"10311406","processID":"416","threadID":"356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.901+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":199,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2011837","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:59:29.6988687Z\",\"eventRecordID\":\"10311407\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:59:29.6988687Z","eventRecordID":"10311407","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.925+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2011837","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T17:59:29.6989027Z\",\"eventRecordID\":\"10311408\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T17:59:29.6989027Z","eventRecordID":"10311408","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.943+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":200,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2019946","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:11:48.5069607Z\",\"eventRecordID\":\"10311409\",\"processID\":\"416\",\"threadID\":\"1824\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:11:48.5069607Z","eventRecordID":"10311409","processID":"416","threadID":"1824","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.957+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2019946","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:11:48.5069771Z\",\"eventRecordID\":\"10311410\",\"processID\":\"416\",\"threadID\":\"1824\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:11:48.5069771Z","eventRecordID":"10311410","processID":"416","threadID":"1824","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.963+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":27,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2028055","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:12:36.4502125Z\",\"eventRecordID\":\"10311411\",\"processID\":\"4\",\"threadID\":\"11668\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1086/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1086/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:12:36.4502125Z","eventRecordID":"10311411","processID":"4","threadID":"11668","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1086/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1086/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.975+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":28,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2031658","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:14:31.4270696Z\",\"eventRecordID\":\"10311412\",\"processID\":\"4\",\"threadID\":\"13772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1801/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1801/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:14:31.4270696Z","eventRecordID":"10311412","processID":"4","threadID":"13772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1801/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1801/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:14.993+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":201,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315174.2035261","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:16:00.0736789Z\",\"eventRecordID\":\"10311413\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:16:00.0736789Z","eventRecordID":"10311413","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.018+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2035261","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:16:00.0737014Z\",\"eventRecordID\":\"10311414\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:16:00.0737014Z","eventRecordID":"10311414","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.033+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":202,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2043370","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:18.9307431Z\",\"eventRecordID\":\"10311415\",\"processID\":\"416\",\"threadID\":\"19432\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:18.9307431Z","eventRecordID":"10311415","processID":"416","threadID":"19432","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.050+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2043370","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:18.9307676Z\",\"eventRecordID\":\"10311416\",\"processID\":\"416\",\"threadID\":\"19432\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:18.9307676Z","eventRecordID":"10311416","processID":"416","threadID":"19432","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.065+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":203,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2051481","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:21.1224374Z\",\"eventRecordID\":\"10311417\",\"processID\":\"416\",\"threadID\":\"19432\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:21.1224374Z","eventRecordID":"10311417","processID":"416","threadID":"19432","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.075+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2051481","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:21.1224525Z\",\"eventRecordID\":\"10311418\",\"processID\":\"416\",\"threadID\":\"19432\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:21.1224525Z","eventRecordID":"10311418","processID":"416","threadID":"19432","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.090+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":204,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2059592","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:21.5082050Z\",\"eventRecordID\":\"10311419\",\"processID\":\"416\",\"threadID\":\"1412\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:21.5082050Z","eventRecordID":"10311419","processID":"416","threadID":"1412","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.110+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2059592","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:21.5082192Z\",\"eventRecordID\":\"10311420\",\"processID\":\"416\",\"threadID\":\"1412\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:21.5082192Z","eventRecordID":"10311420","processID":"416","threadID":"1412","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.124+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":205,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2067701","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:24.5077309Z\",\"eventRecordID\":\"10311421\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:24.5077309Z","eventRecordID":"10311421","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.145+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2067701","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:24.5077471Z\",\"eventRecordID\":\"10311422\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:24.5077471Z","eventRecordID":"10311422","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.160+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":14,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2067701","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:28.8984635Z\",\"eventRecordID\":\"10311423\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF95214E\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf95214e\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:28.8984635Z","eventRecordID":"10311423","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF95214E\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf95214e","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.170+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2075810","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:28.8984850Z\",\"eventRecordID\":\"10311424\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xF95214E\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xf95214e\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:28.8984850Z","eventRecordID":"10311424","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xF95214E\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xf95214e","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.178+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":29,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2083998","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:30.0727289Z\",\"eventRecordID\":\"10311425\",\"processID\":\"4\",\"threadID\":\"10788\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:30.0727289Z","eventRecordID":"10311425","processID":"4","threadID":"10788","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.197+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":206,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2087427","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:30.0848926Z\",\"eventRecordID\":\"10311426\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:30.0848926Z","eventRecordID":"10311426","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.222+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2087427","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:30.0849080Z\",\"eventRecordID\":\"10311427\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:30.0849080Z","eventRecordID":"10311427","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.229+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":30,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2095536","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:30.0863298Z\",\"eventRecordID\":\"10311428\",\"processID\":\"4\",\"threadID\":\"13196\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:30.0863298Z","eventRecordID":"10311428","processID":"4","threadID":"13196","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.253+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":31,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2098761","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:31.9139852Z\",\"eventRecordID\":\"10311429\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1801/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1801/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:31.9139852Z","eventRecordID":"10311429","processID":"4","threadID":"16224","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1801/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1801/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.266+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":207,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2102364","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:46.3981502Z\",\"eventRecordID\":\"10311430\",\"processID\":\"416\",\"threadID\":\"19432\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:46.3981502Z","eventRecordID":"10311430","processID":"416","threadID":"19432","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.288+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2102364","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:20:46.3981677Z\",\"eventRecordID\":\"10311431\",\"processID\":\"416\",\"threadID\":\"19432\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:20:46.3981677Z","eventRecordID":"10311431","processID":"416","threadID":"19432","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.299+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":208,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2102364","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:24:34.2778986Z\",\"eventRecordID\":\"10311432\",\"processID\":\"416\",\"threadID\":\"19484\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:24:34.2778986Z","eventRecordID":"10311432","processID":"416","threadID":"19484","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.316+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2110475","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:24:34.2779167Z\",\"eventRecordID\":\"10311433\",\"processID\":\"416\",\"threadID\":\"19484\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:24:34.2779167Z","eventRecordID":"10311433","processID":"416","threadID":"19484","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.330+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":209,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2118586","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:25:11.8251350Z\",\"eventRecordID\":\"10311434\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:25:11.8251350Z","eventRecordID":"10311434","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.346+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2118586","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:25:11.8251706Z\",\"eventRecordID\":\"10311435\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:25:11.8251706Z","eventRecordID":"10311435","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.362+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":210,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2118586","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:28:22.2946316Z\",\"eventRecordID\":\"10311436\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:28:22.2946316Z","eventRecordID":"10311436","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.371+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2126695","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:28:22.2946695Z\",\"eventRecordID\":\"10311437\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:28:22.2946695Z","eventRecordID":"10311437","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.386+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":211,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2134804","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:30:32.6822643Z\",\"eventRecordID\":\"10311438\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:30:32.6822643Z","eventRecordID":"10311438","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.405+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2134804","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:30:32.6822882Z\",\"eventRecordID\":\"10311439\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:30:32.6822882Z","eventRecordID":"10311439","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.420+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":212,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2134804","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:33:34.6953077Z\",\"eventRecordID\":\"10311440\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:33:34.6953077Z","eventRecordID":"10311440","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.442+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2142913","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:33:34.6953233Z\",\"eventRecordID\":\"10311441\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:33:34.6953233Z","eventRecordID":"10311441","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.455+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":213,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2151022","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:34:19.5241593Z\",\"eventRecordID\":\"10311442\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:34:19.5241593Z","eventRecordID":"10311442","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.472+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2151022","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:34:19.5241926Z\",\"eventRecordID\":\"10311443\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:34:19.5241926Z","eventRecordID":"10311443","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.486+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":214,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2159131","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:46:56.1549932Z\",\"eventRecordID\":\"10311444\",\"processID\":\"416\",\"threadID\":\"2112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:46:56.1549932Z","eventRecordID":"10311444","processID":"416","threadID":"2112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.496+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2159131","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:46:56.1550279Z\",\"eventRecordID\":\"10311445\",\"processID\":\"416\",\"threadID\":\"2112\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:46:56.1550279Z","eventRecordID":"10311445","processID":"416","threadID":"2112","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.512+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":215,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2167240","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:15.9270496Z\",\"eventRecordID\":\"10311446\",\"processID\":\"416\",\"threadID\":\"9268\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:15.9270496Z","eventRecordID":"10311446","processID":"416","threadID":"9268","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.535+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2167240","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:15.9270733Z\",\"eventRecordID\":\"10311447\",\"processID\":\"416\",\"threadID\":\"9268\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:15.9270733Z","eventRecordID":"10311447","processID":"416","threadID":"9268","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.553+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":216,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2175349","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:18.1250858Z\",\"eventRecordID\":\"10311448\",\"processID\":\"416\",\"threadID\":\"9268\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:18.1250858Z","eventRecordID":"10311448","processID":"416","threadID":"9268","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.566+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2175349","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:18.1251024Z\",\"eventRecordID\":\"10311449\",\"processID\":\"416\",\"threadID\":\"9268\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:18.1251024Z","eventRecordID":"10311449","processID":"416","threadID":"9268","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.582+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":217,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2183458","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:18.5096215Z\",\"eventRecordID\":\"10311450\",\"processID\":\"416\",\"threadID\":\"15136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:18.5096215Z","eventRecordID":"10311450","processID":"416","threadID":"15136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.597+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2183458","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:18.5096369Z\",\"eventRecordID\":\"10311451\",\"processID\":\"416\",\"threadID\":\"15136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:18.5096369Z","eventRecordID":"10311451","processID":"416","threadID":"15136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.614+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":218,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2191569","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:21.5088988Z\",\"eventRecordID\":\"10311452\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:21.5088988Z","eventRecordID":"10311452","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.625+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2191569","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:21.5089221Z\",\"eventRecordID\":\"10311453\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:21.5089221Z","eventRecordID":"10311453","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.640+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":15,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2199678","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:22.3770248Z\",\"eventRecordID\":\"10311454\",\"processID\":\"416\",\"threadID\":\"15136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFA5AB27\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfa5ab27\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:22.3770248Z","eventRecordID":"10311454","processID":"416","threadID":"15136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFA5AB27\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfa5ab27","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.651+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2199678","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:22.3770469Z\",\"eventRecordID\":\"10311455\",\"processID\":\"416\",\"threadID\":\"15136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFA5AB27\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfa5ab27\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:22.3770469Z","eventRecordID":"10311455","processID":"416","threadID":"15136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFA5AB27\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfa5ab27","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.658+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":32,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2207868","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:23.5569963Z\",\"eventRecordID\":\"10311456\",\"processID\":\"4\",\"threadID\":\"13196\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:23.5569963Z","eventRecordID":"10311456","processID":"4","threadID":"13196","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.681+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":219,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2211297","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:23.5686610Z\",\"eventRecordID\":\"10311457\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:23.5686610Z","eventRecordID":"10311457","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.707+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2211297","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:23.5686761Z\",\"eventRecordID\":\"10311458\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:23.5686761Z","eventRecordID":"10311458","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.713+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":33,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2219408","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:23.5700633Z\",\"eventRecordID\":\"10311459\",\"processID\":\"4\",\"threadID\":\"13196\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:23.5700633Z","eventRecordID":"10311459","processID":"4","threadID":"13196","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.740+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":34,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2222633","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:25.2625350Z\",\"eventRecordID\":\"10311460\",\"processID\":\"4\",\"threadID\":\"19592\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1801/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1801/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:25.2625350Z","eventRecordID":"10311460","processID":"4","threadID":"19592","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1801/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1801/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.750+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":220,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2226236","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:43.4620093Z\",\"eventRecordID\":\"10311461\",\"processID\":\"416\",\"threadID\":\"9268\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:43.4620093Z","eventRecordID":"10311461","processID":"416","threadID":"9268","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.769+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2226236","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:51:43.4620268Z\",\"eventRecordID\":\"10311462\",\"processID\":\"416\",\"threadID\":\"9268\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:51:43.4620268Z","eventRecordID":"10311462","processID":"416","threadID":"9268","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.776+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":35,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2234345","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:53:31.7602994Z\",\"eventRecordID\":\"10311463\",\"processID\":\"4\",\"threadID\":\"8088\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1975/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1975/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:53:31.7602994Z","eventRecordID":"10311463","processID":"4","threadID":"8088","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1975/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1975/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.792+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":221,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2234345","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:55:19.9466575Z\",\"eventRecordID\":\"10311464\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:55:19.9466575Z","eventRecordID":"10311464","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.813+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2237946","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:55:19.9466763Z\",\"eventRecordID\":\"10311465\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:55:19.9466763Z","eventRecordID":"10311465","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.825+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":222,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2237946","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:55:27.7571335Z\",\"eventRecordID\":\"10311466\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:55:27.7571335Z","eventRecordID":"10311466","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.847+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2246055","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:55:27.7571481Z\",\"eventRecordID\":\"10311467\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:55:27.7571481Z","eventRecordID":"10311467","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.861+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":223,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2246055","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:56:09.9198033Z\",\"eventRecordID\":\"10311468\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:56:09.9198033Z","eventRecordID":"10311468","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.878+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2254164","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:56:09.9198390Z\",\"eventRecordID\":\"10311469\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:56:09.9198390Z","eventRecordID":"10311469","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.894+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":224,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2254164","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:59:24.6081923Z\",\"eventRecordID\":\"10311470\",\"processID\":\"416\",\"threadID\":\"10892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:59:24.6081923Z","eventRecordID":"10311470","processID":"416","threadID":"10892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.905+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2262275","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T18:59:24.6082271Z\",\"eventRecordID\":\"10311471\",\"processID\":\"416\",\"threadID\":\"10892\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T18:59:24.6082271Z","eventRecordID":"10311471","processID":"416","threadID":"10892","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.920+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":225,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2262275","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:01:26.1519421Z\",\"eventRecordID\":\"10311472\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:01:26.1519421Z","eventRecordID":"10311472","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.941+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2270386","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:01:26.1519627Z\",\"eventRecordID\":\"10311473\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:01:26.1519627Z","eventRecordID":"10311473","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.959+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":226,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2270386","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:16:38.1654853Z\",\"eventRecordID\":\"10311474\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:16:38.1654853Z","eventRecordID":"10311474","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.974+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2278495","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:16:38.1655015Z\",\"eventRecordID\":\"10311475\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:16:38.1655015Z","eventRecordID":"10311475","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:15.989+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":227,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315175.2278495","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:17:54.0473031Z\",\"eventRecordID\":\"10311476\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:17:54.0473031Z","eventRecordID":"10311476","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.006+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2286604","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:17:54.0473374Z\",\"eventRecordID\":\"10311477\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:17:54.0473374Z","eventRecordID":"10311477","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.022+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":228,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2294713","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:17:54.0869639Z\",\"eventRecordID\":\"10311478\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:17:54.0869639Z","eventRecordID":"10311478","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.034+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2294713","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:17:54.0869807Z\",\"eventRecordID\":\"10311479\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:17:54.0869807Z","eventRecordID":"10311479","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.051+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":229,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2302822","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:17:54.1493351Z\",\"eventRecordID\":\"10311480\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:17:54.1493351Z","eventRecordID":"10311480","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.061+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2302822","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:17:54.1493518Z\",\"eventRecordID\":\"10311481\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:17:54.1493518Z","eventRecordID":"10311481","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.077+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":230,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2302822","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:43.9716825Z\",\"eventRecordID\":\"10311482\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:43.9716825Z","eventRecordID":"10311482","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.088+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2310931","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:43.9717069Z\",\"eventRecordID\":\"10311483\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:43.9717069Z","eventRecordID":"10311483","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.103+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":231,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2310931","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:46.1803862Z\",\"eventRecordID\":\"10311484\",\"processID\":\"416\",\"threadID\":\"14028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:46.1803862Z","eventRecordID":"10311484","processID":"416","threadID":"14028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.122+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2319042","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:46.1804112Z\",\"eventRecordID\":\"10311485\",\"processID\":\"416\",\"threadID\":\"14028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:46.1804112Z","eventRecordID":"10311485","processID":"416","threadID":"14028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.137+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":232,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2327153","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:46.5147507Z\",\"eventRecordID\":\"10311486\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:46.5147507Z","eventRecordID":"10311486","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.161+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2327153","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:46.5147774Z\",\"eventRecordID\":\"10311487\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:46.5147774Z","eventRecordID":"10311487","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.175+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":16,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2327153","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:48.9107172Z\",\"eventRecordID\":\"10311488\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFB61C77\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfb61c77\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:48.9107172Z","eventRecordID":"10311488","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFB61C77\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfb61c77","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.187+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2335264","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:48.9107382Z\",\"eventRecordID\":\"10311489\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFB61C77\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfb61c77\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:48.9107382Z","eventRecordID":"10311489","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFB61C77\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfb61c77","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.194+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":36,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2335264","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:50.0956310Z\",\"eventRecordID\":\"10311490\",\"processID\":\"4\",\"threadID\":\"16224\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:50.0956310Z","eventRecordID":"10311490","processID":"4","threadID":"16224","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.213+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":233,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2346883","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:50.1109423Z\",\"eventRecordID\":\"10311491\",\"processID\":\"416\",\"threadID\":\"13724\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:50.1109423Z","eventRecordID":"10311491","processID":"416","threadID":"13724","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.239+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2346883","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:50.1109607Z\",\"eventRecordID\":\"10311492\",\"processID\":\"416\",\"threadID\":\"13724\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:50.1109607Z","eventRecordID":"10311492","processID":"416","threadID":"13724","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.245+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":37,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2354994","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:23:50.1126040Z\",\"eventRecordID\":\"10311493\",\"processID\":\"4\",\"threadID\":\"16240\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:23:50.1126040Z","eventRecordID":"10311493","processID":"4","threadID":"16240","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.261+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":234,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2354994","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:24:11.3994545Z\",\"eventRecordID\":\"10311494\",\"processID\":\"416\",\"threadID\":\"14028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:24:11.3994545Z","eventRecordID":"10311494","processID":"416","threadID":"14028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.272+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2358219","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:24:11.3994706Z\",\"eventRecordID\":\"10311495\",\"processID\":\"416\",\"threadID\":\"14028\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:24:11.3994706Z","eventRecordID":"10311495","processID":"416","threadID":"14028","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.291+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":235,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2358219","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:27:06.5764061Z\",\"eventRecordID\":\"10311496\",\"processID\":\"416\",\"threadID\":\"13724\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:27:06.5764061Z","eventRecordID":"10311496","processID":"416","threadID":"13724","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.308+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2366330","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:27:06.5764407Z\",\"eventRecordID\":\"10311497\",\"processID\":\"416\",\"threadID\":\"13724\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:27:06.5764407Z","eventRecordID":"10311497","processID":"416","threadID":"13724","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.322+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":236,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2374441","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:27:54.3570983Z\",\"eventRecordID\":\"10311498\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:27:54.3570983Z","eventRecordID":"10311498","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.349+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2374441","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:27:54.3571141Z\",\"eventRecordID\":\"10311499\",\"processID\":\"416\",\"threadID\":\"17828\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:27:54.3571141Z","eventRecordID":"10311499","processID":"416","threadID":"17828","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.362+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":237,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2382552","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:30:19.7176691Z\",\"eventRecordID\":\"10311500\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:30:19.7176691Z","eventRecordID":"10311500","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.379+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2382552","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:30:19.7177070Z\",\"eventRecordID\":\"10311501\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:30:19.7177070Z","eventRecordID":"10311501","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.393+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":238,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2390661","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:32:46.2007917Z\",\"eventRecordID\":\"10311502\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:32:46.2007917Z","eventRecordID":"10311502","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.404+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2390661","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:32:46.2008251Z\",\"eventRecordID\":\"10311503\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:32:46.2008251Z","eventRecordID":"10311503","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.419+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":239,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2398770","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:38:24.3839878Z\",\"eventRecordID\":\"10311504\",\"processID\":\"416\",\"threadID\":\"13724\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:38:24.3839878Z","eventRecordID":"10311504","processID":"416","threadID":"13724","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.438+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2398770","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:38:24.3840039Z\",\"eventRecordID\":\"10311505\",\"processID\":\"416\",\"threadID\":\"13724\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:38:24.3840039Z","eventRecordID":"10311505","processID":"416","threadID":"13724","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.453+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":240,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2406881","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:48:50.0626187Z\",\"eventRecordID\":\"10311506\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:48:50.0626187Z","eventRecordID":"10311506","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.473+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2406881","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:48:50.0626534Z\",\"eventRecordID\":\"10311507\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:48:50.0626534Z","eventRecordID":"10311507","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.487+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":241,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2414990","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:50:14.5881813Z\",\"eventRecordID\":\"10311508\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:50:14.5881813Z","eventRecordID":"10311508","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.507+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2414990","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:50:14.5882141Z\",\"eventRecordID\":\"10311509\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:50:14.5882141Z","eventRecordID":"10311509","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.523+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":242,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2423099","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:51:06.4243486Z\",\"eventRecordID\":\"10311510\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:51:06.4243486Z","eventRecordID":"10311510","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.534+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2423099","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:51:06.4243653Z\",\"eventRecordID\":\"10311511\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:51:06.4243653Z","eventRecordID":"10311511","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.549+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":243,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2431208","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:51:08.6248708Z\",\"eventRecordID\":\"10311512\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:51:08.6248708Z","eventRecordID":"10311512","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.558+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2431208","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:51:08.6248872Z\",\"eventRecordID\":\"10311513\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:51:08.6248872Z","eventRecordID":"10311513","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.571+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":244,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2431208","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:43.6203887Z\",\"eventRecordID\":\"10311514\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:43.6203887Z","eventRecordID":"10311514","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.584+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2439317","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:43.6204121Z\",\"eventRecordID\":\"10311515\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:43.6204121Z","eventRecordID":"10311515","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.602+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":245,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2447426","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:44.5130842Z\",\"eventRecordID\":\"10311516\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:44.5130842Z","eventRecordID":"10311516","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.620+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2447426","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:44.5131076Z\",\"eventRecordID\":\"10311517\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:44.5131076Z","eventRecordID":"10311517","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.634+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":17,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2447426","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:46.9276699Z\",\"eventRecordID\":\"10311518\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFC849E2\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfc849e2\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:46.9276699Z","eventRecordID":"10311518","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFC849E2\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfc849e2","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.646+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2455535","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:46.9276928Z\",\"eventRecordID\":\"10311519\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFC849E2\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfc849e2\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:46.9276928Z","eventRecordID":"10311519","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFC849E2\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfc849e2","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.661+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":38,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2463723","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:48.1307979Z\",\"eventRecordID\":\"10311520\",\"processID\":\"4\",\"threadID\":\"8196\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:48.1307979Z","eventRecordID":"10311520","processID":"4","threadID":"8196","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.680+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":246,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2463723","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:48.1412434Z\",\"eventRecordID\":\"10311521\",\"processID\":\"416\",\"threadID\":\"12896\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:48.1412434Z","eventRecordID":"10311521","processID":"416","threadID":"12896","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.695+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2467150","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:48.1412598Z\",\"eventRecordID\":\"10311522\",\"processID\":\"416\",\"threadID\":\"12896\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:48.1412598Z","eventRecordID":"10311522","processID":"416","threadID":"12896","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.710+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":39,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2475261","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:48.1429168Z\",\"eventRecordID\":\"10311523\",\"processID\":\"4\",\"threadID\":\"1364\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:48.1429168Z","eventRecordID":"10311523","processID":"4","threadID":"1364","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.731+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":247,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2478484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:48.9659852Z\",\"eventRecordID\":\"10311524\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:48.9659852Z","eventRecordID":"10311524","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.745+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2478484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:54:48.9660077Z\",\"eventRecordID\":\"10311525\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:54:48.9660077Z","eventRecordID":"10311525","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.760+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":248,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2486593","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:58:04.5795024Z\",\"eventRecordID\":\"10311526\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:58:04.5795024Z","eventRecordID":"10311526","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.785+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2486593","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:58:04.5795369Z\",\"eventRecordID\":\"10311527\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:58:04.5795369Z","eventRecordID":"10311527","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.798+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":249,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2494702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:58:52.3994571Z\",\"eventRecordID\":\"10311528\",\"processID\":\"416\",\"threadID\":\"18676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:58:52.3994571Z","eventRecordID":"10311528","processID":"416","threadID":"18676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.814+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2494702","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T19:58:52.3994725Z\",\"eventRecordID\":\"10311529\",\"processID\":\"416\",\"threadID\":\"18676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T19:58:52.3994725Z","eventRecordID":"10311529","processID":"416","threadID":"18676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.829+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":250,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2502813","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:00:10.6372410Z\",\"eventRecordID\":\"10311530\",\"processID\":\"416\",\"threadID\":\"18676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:00:10.6372410Z","eventRecordID":"10311530","processID":"416","threadID":"18676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.840+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2502813","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:00:10.6372569Z\",\"eventRecordID\":\"10311531\",\"processID\":\"416\",\"threadID\":\"18676\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:00:10.6372569Z","eventRecordID":"10311531","processID":"416","threadID":"18676","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.991+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":251,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:19:49.2529168Z\",\"eventRecordID\":\"10311534\",\"processID\":\"416\",\"threadID\":\"20340\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:19:49.2529168Z","eventRecordID":"10311534","processID":"416","threadID":"20340","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.992+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:19:49.2529507Z\",\"eventRecordID\":\"10311535\",\"processID\":\"416\",\"threadID\":\"20340\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:19:49.2529507Z","eventRecordID":"10311535","processID":"416","threadID":"20340","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.991+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:02:17.6116263Z\",\"eventRecordID\":\"10311533\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:02:17.6116263Z","eventRecordID":"10311533","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.992+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":252,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:21:28.8881673Z\",\"eventRecordID\":\"10311536\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:21:28.8881673Z","eventRecordID":"10311536","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.992+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":253,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:02:17.6115885Z\",\"eventRecordID\":\"10311532\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:02:17.6115885Z","eventRecordID":"10311532","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.994+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:21:28.8882020Z\",\"eventRecordID\":\"10311537\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:21:28.8882020Z","eventRecordID":"10311537","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.995+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":254,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:39.9630936Z\",\"eventRecordID\":\"10311538\",\"processID\":\"416\",\"threadID\":\"18736\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:39.9630936Z","eventRecordID":"10311538","processID":"416","threadID":"18736","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.995+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":255,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:42.1923890Z\",\"eventRecordID\":\"10311540\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:42.1923890Z","eventRecordID":"10311540","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:16.995+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315176.2510924","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:39.9631193Z\",\"eventRecordID\":\"10311539\",\"processID\":\"416\",\"threadID\":\"18736\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:39.9631193Z","eventRecordID":"10311539","processID":"416","threadID":"18736","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.002+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2543364","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:42.1924038Z\",\"eventRecordID\":\"10311541\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:42.1924038Z","eventRecordID":"10311541","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.020+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":256,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2551473","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:42.5115935Z\",\"eventRecordID\":\"10311542\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:42.5115935Z","eventRecordID":"10311542","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.036+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2551473","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:42.5116201Z\",\"eventRecordID\":\"10311543\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:42.5116201Z","eventRecordID":"10311543","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.047+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":18,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2559582","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:44.8793729Z\",\"eventRecordID\":\"10311544\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFD89282\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfd89282\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:44.8793729Z","eventRecordID":"10311544","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFD89282\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfd89282","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.059+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2559582","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:44.8793944Z\",\"eventRecordID\":\"10311545\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFD89282\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfd89282\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:44.8793944Z","eventRecordID":"10311545","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFD89282\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfd89282","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.075+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":257,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2567770","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:45.0067756Z\",\"eventRecordID\":\"10311546\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:45.0067756Z","eventRecordID":"10311546","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.086+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2567770","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:45.0067912Z\",\"eventRecordID\":\"10311547\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:45.0067912Z","eventRecordID":"10311547","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.107+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":40,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2575879","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:46.1190309Z\",\"eventRecordID\":\"10311548\",\"processID\":\"4\",\"threadID\":\"8312\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:46.1190309Z","eventRecordID":"10311548","processID":"4","threadID":"8312","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.127+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":258,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2579306","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:46.1306063Z\",\"eventRecordID\":\"10311549\",\"processID\":\"416\",\"threadID\":\"8576\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:46.1306063Z","eventRecordID":"10311549","processID":"416","threadID":"8576","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.142+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2579306","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:46.1306226Z\",\"eventRecordID\":\"10311550\",\"processID\":\"416\",\"threadID\":\"8576\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:46.1306226Z","eventRecordID":"10311550","processID":"416","threadID":"8576","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.230+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2579306","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:26:07.4476345Z\",\"eventRecordID\":\"10311553\",\"processID\":\"416\",\"threadID\":\"18736\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:26:07.4476345Z","eventRecordID":"10311553","processID":"416","threadID":"18736","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.231+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2590640","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:29:32.7161646Z\",\"eventRecordID\":\"10311555\",\"processID\":\"416\",\"threadID\":\"14628\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:29:32.7161646Z","eventRecordID":"10311555","processID":"416","threadID":"14628","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.230+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":41,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2590640","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:25:46.1319077Z\",\"eventRecordID\":\"10311551\",\"processID\":\"4\",\"threadID\":\"14772\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:25:46.1319077Z","eventRecordID":"10311551","processID":"4","threadID":"14772","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.230+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":259,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2590640","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:26:07.4476177Z\",\"eventRecordID\":\"10311552\",\"processID\":\"416\",\"threadID\":\"18736\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:26:07.4476177Z","eventRecordID":"10311552","processID":"416","threadID":"18736","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.230+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":260,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2598751","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:29:32.7161425Z\",\"eventRecordID\":\"10311554\",\"processID\":\"416\",\"threadID\":\"14628\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:29:32.7161425Z","eventRecordID":"10311554","processID":"416","threadID":"14628","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.238+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":261,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2606862","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:29:50.3622336Z\",\"eventRecordID\":\"10311556\",\"processID\":\"416\",\"threadID\":\"18880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:29:50.3622336Z","eventRecordID":"10311556","processID":"416","threadID":"18880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.251+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2606862","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:29:50.3622508Z\",\"eventRecordID\":\"10311557\",\"processID\":\"416\",\"threadID\":\"18880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:29:50.3622508Z","eventRecordID":"10311557","processID":"416","threadID":"18880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.266+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":262,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2614973","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:33:13.7354564Z\",\"eventRecordID\":\"10311558\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:33:13.7354564Z","eventRecordID":"10311558","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.276+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2614973","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:33:13.7354901Z\",\"eventRecordID\":\"10311559\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:33:13.7354901Z","eventRecordID":"10311559","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.292+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":263,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2614973","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:43:15.1516401Z\",\"eventRecordID\":\"10311560\",\"processID\":\"416\",\"threadID\":\"10356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:43:15.1516401Z","eventRecordID":"10311560","processID":"416","threadID":"10356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.305+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2623082","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:43:15.1516804Z\",\"eventRecordID\":\"10311561\",\"processID\":\"416\",\"threadID\":\"10356\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:43:15.1516804Z","eventRecordID":"10311561","processID":"416","threadID":"10356","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.319+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":264,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2623082","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:50:48.8478793Z\",\"eventRecordID\":\"10311562\",\"processID\":\"416\",\"threadID\":\"16912\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:50:48.8478793Z","eventRecordID":"10311562","processID":"416","threadID":"16912","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.339+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2631193","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:50:48.8479239Z\",\"eventRecordID\":\"10311563\",\"processID\":\"416\",\"threadID\":\"16912\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:50:48.8479239Z","eventRecordID":"10311563","processID":"416","threadID":"16912","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.354+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":265,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2631193","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:36.9313163Z\",\"eventRecordID\":\"10311564\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:36.9313163Z","eventRecordID":"10311564","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.374+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2639304","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:36.9313402Z\",\"eventRecordID\":\"10311565\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:36.9313402Z","eventRecordID":"10311565","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.389+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":266,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2639304","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:39.1233347Z\",\"eventRecordID\":\"10311566\",\"processID\":\"416\",\"threadID\":\"10136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:39.1233347Z","eventRecordID":"10311566","processID":"416","threadID":"10136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.409+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2647413","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:39.1233498Z\",\"eventRecordID\":\"10311567\",\"processID\":\"416\",\"threadID\":\"10136\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:39.1233498Z","eventRecordID":"10311567","processID":"416","threadID":"10136","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.421+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":267,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2655524","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:39.5148185Z\",\"eventRecordID\":\"10311568\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:39.5148185Z","eventRecordID":"10311568","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.432+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2655524","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:39.5148409Z\",\"eventRecordID\":\"10311569\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:39.5148409Z","eventRecordID":"10311569","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.447+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":19,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2655524","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:41.9193205Z\",\"eventRecordID\":\"10311570\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFE76E19\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfe76e19\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:41.9193205Z","eventRecordID":"10311570","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFE76E19\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfe76e19","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.464+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2663633","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:41.9193609Z\",\"eventRecordID\":\"10311571\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFE76E19\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xfe76e19\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:41.9193609Z","eventRecordID":"10311571","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFE76E19\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xfe76e19","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.478+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":42,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2671821","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:43.1117433Z\",\"eventRecordID\":\"10311572\",\"processID\":\"4\",\"threadID\":\"6484\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:43.1117433Z","eventRecordID":"10311572","processID":"4","threadID":"6484","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.493+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":268,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2675248","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:43.1228737Z\",\"eventRecordID\":\"10311573\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:43.1228737Z","eventRecordID":"10311573","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.512+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2675248","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:43.1228892Z\",\"eventRecordID\":\"10311574\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:43.1228892Z","eventRecordID":"10311574","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.524+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":43,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2683357","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:43.1241793Z\",\"eventRecordID\":\"10311575\",\"processID\":\"4\",\"threadID\":\"11048\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:43.1241793Z","eventRecordID":"10311575","processID":"4","threadID":"11048","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.539+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":269,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2686582","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:44.4958777Z\",\"eventRecordID\":\"10311576\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:44.4958777Z","eventRecordID":"10311576","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.549+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2686582","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:56:44.4959086Z\",\"eventRecordID\":\"10311577\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:56:44.4959086Z","eventRecordID":"10311577","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.567+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":270,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2694691","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:57:04.3884440Z\",\"eventRecordID\":\"10311578\",\"processID\":\"416\",\"threadID\":\"11880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:57:04.3884440Z","eventRecordID":"10311578","processID":"416","threadID":"11880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.584+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2694691","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:57:04.3884615Z\",\"eventRecordID\":\"10311579\",\"processID\":\"416\",\"threadID\":\"11880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:57:04.3884615Z","eventRecordID":"10311579","processID":"416","threadID":"11880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.598+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":44,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2702802","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T20:59:05.7841784Z\",\"eventRecordID\":\"10311580\",\"processID\":\"4\",\"threadID\":\"5284\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1158/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1158/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T20:59:05.7841784Z","eventRecordID":"10311580","processID":"4","threadID":"5284","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1158/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1158/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.616+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":271,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2706403","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:00:31.2659478Z\",\"eventRecordID\":\"10311581\",\"processID\":\"416\",\"threadID\":\"16912\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:00:31.2659478Z","eventRecordID":"10311581","processID":"416","threadID":"16912","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.633+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2706403","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:00:31.2659698Z\",\"eventRecordID\":\"10311582\",\"processID\":\"416\",\"threadID\":\"16912\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:00:31.2659698Z","eventRecordID":"10311582","processID":"416","threadID":"16912","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.648+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":272,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2714514","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:00:47.4234167Z\",\"eventRecordID\":\"10311583\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:00:47.4234167Z","eventRecordID":"10311583","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.668+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2714514","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:00:47.4234348Z\",\"eventRecordID\":\"10311584\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:00:47.4234348Z","eventRecordID":"10311584","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.683+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":273,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2722623","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:04:14.7382850Z\",\"eventRecordID\":\"10311585\",\"processID\":\"416\",\"threadID\":\"11880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:04:14.7382850Z","eventRecordID":"10311585","processID":"416","threadID":"11880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.703+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2722623","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:04:14.7383251Z\",\"eventRecordID\":\"10311586\",\"processID\":\"416\",\"threadID\":\"11880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:04:14.7383251Z","eventRecordID":"10311586","processID":"416","threadID":"11880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.718+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":274,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2730734","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:05:00.3586946Z\",\"eventRecordID\":\"10311587\",\"processID\":\"416\",\"threadID\":\"11880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:05:00.3586946Z","eventRecordID":"10311587","processID":"416","threadID":"11880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.736+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2730734","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:05:00.3587351Z\",\"eventRecordID\":\"10311588\",\"processID\":\"416\",\"threadID\":\"11880\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:05:00.3587351Z","eventRecordID":"10311588","processID":"416","threadID":"11880","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.751+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":275,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2738845","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:21:47.0352128Z\",\"eventRecordID\":\"10311589\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:21:47.0352128Z","eventRecordID":"10311589","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.768+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2738845","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:21:47.0352462Z\",\"eventRecordID\":\"10311590\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:21:47.0352462Z","eventRecordID":"10311590","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.782+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":276,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2746954","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:26:18.6231942Z\",\"eventRecordID\":\"10311591\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:26:18.6231942Z","eventRecordID":"10311591","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.793+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2746954","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:26:18.6232105Z\",\"eventRecordID\":\"10311592\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:26:18.6232105Z","eventRecordID":"10311592","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.809+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":277,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2755063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:35.9356645Z\",\"eventRecordID\":\"10311593\",\"processID\":\"416\",\"threadID\":\"11212\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:35.9356645Z","eventRecordID":"10311593","processID":"416","threadID":"11212","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.820+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2755063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:35.9356883Z\",\"eventRecordID\":\"10311594\",\"processID\":\"416\",\"threadID\":\"11212\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:35.9356883Z","eventRecordID":"10311594","processID":"416","threadID":"11212","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.836+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":278,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2763174","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:38.0798208Z\",\"eventRecordID\":\"10311595\",\"processID\":\"416\",\"threadID\":\"11212\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:38.0798208Z","eventRecordID":"10311595","processID":"416","threadID":"11212","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.864+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2763174","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:38.0798355Z\",\"eventRecordID\":\"10311596\",\"processID\":\"416\",\"threadID\":\"11212\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:38.0798355Z","eventRecordID":"10311596","processID":"416","threadID":"11212","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.878+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":279,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2763174","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:38.5154328Z\",\"eventRecordID\":\"10311597\",\"processID\":\"416\",\"threadID\":\"11212\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:38.5154328Z","eventRecordID":"10311597","processID":"416","threadID":"11212","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.894+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2771285","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:38.5154481Z\",\"eventRecordID\":\"10311598\",\"processID\":\"416\",\"threadID\":\"11212\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:38.5154481Z","eventRecordID":"10311598","processID":"416","threadID":"11212","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.908+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":280,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2779396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:41.9994089Z\",\"eventRecordID\":\"10311599\",\"processID\":\"416\",\"threadID\":\"3524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:41.9994089Z","eventRecordID":"10311599","processID":"416","threadID":"3524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.921+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2779396","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:41.9994321Z\",\"eventRecordID\":\"10311600\",\"processID\":\"416\",\"threadID\":\"3524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:41.9994321Z","eventRecordID":"10311600","processID":"416","threadID":"3524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.935+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":45,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2787505","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:46.3362739Z\",\"eventRecordID\":\"10311601\",\"processID\":\"4\",\"threadID\":\"15796\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1158/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1158/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:46.3362739Z","eventRecordID":"10311601","processID":"4","threadID":"15796","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1158/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1158/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.951+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":20,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2791108","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:47.1328155Z\",\"eventRecordID\":\"10311602\",\"processID\":\"416\",\"threadID\":\"16108\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFF7CEB6\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xff7ceb6\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:47.1328155Z","eventRecordID":"10311602","processID":"416","threadID":"16108","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFF7CEB6\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xff7ceb6","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.962+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2791108","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:47.1328361Z\",\"eventRecordID\":\"10311603\",\"processID\":\"416\",\"threadID\":\"16108\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0xFF7CEB6\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0xff7ceb6\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:47.1328361Z","eventRecordID":"10311603","processID":"416","threadID":"16108","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0xFF7CEB6\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0xff7ceb6","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.977+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":46,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2799298","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:48.3122738Z\",\"eventRecordID\":\"10311604\",\"processID\":\"4\",\"threadID\":\"7628\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:48.3122738Z","eventRecordID":"10311604","processID":"4","threadID":"7628","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:17.993+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":281,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315177.2802725","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:48.3237597Z\",\"eventRecordID\":\"10311605\",\"processID\":\"416\",\"threadID\":\"3524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:48.3237597Z","eventRecordID":"10311605","processID":"416","threadID":"3524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.011+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2802725","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:48.3237895Z\",\"eventRecordID\":\"10311606\",\"processID\":\"416\",\"threadID\":\"3524\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:48.3237895Z","eventRecordID":"10311606","processID":"416","threadID":"3524","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.024+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":47,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2802725","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:27:48.3248803Z\",\"eventRecordID\":\"10311607\",\"processID\":\"4\",\"threadID\":\"19380\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:27:48.3248803Z","eventRecordID":"10311607","processID":"4","threadID":"19380","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.044+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":282,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2810834","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:28:03.3893190Z\",\"eventRecordID\":\"10311608\",\"processID\":\"416\",\"threadID\":\"16108\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:28:03.3893190Z","eventRecordID":"10311608","processID":"416","threadID":"16108","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.063+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2814059","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:28:03.3893363Z\",\"eventRecordID\":\"10311609\",\"processID\":\"416\",\"threadID\":\"16108\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:28:03.3893363Z","eventRecordID":"10311609","processID":"416","threadID":"16108","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.078+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":283,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2822170","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:31:29.2078150Z\",\"eventRecordID\":\"10311610\",\"processID\":\"416\",\"threadID\":\"19512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:31:29.2078150Z","eventRecordID":"10311610","processID":"416","threadID":"19512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.091+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2822170","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:31:29.2078497Z\",\"eventRecordID\":\"10311611\",\"processID\":\"416\",\"threadID\":\"19512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:31:29.2078497Z","eventRecordID":"10311611","processID":"416","threadID":"19512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.103+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":284,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2822170","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:31:52.5951355Z\",\"eventRecordID\":\"10311612\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:31:52.5951355Z","eventRecordID":"10311612","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.125+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2830281","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:31:52.5951502Z\",\"eventRecordID\":\"10311613\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:31:52.5951502Z","eventRecordID":"10311613","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.143+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":285,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2838390","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:35:08.6619310Z\",\"eventRecordID\":\"10311614\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:35:08.6619310Z","eventRecordID":"10311614","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.161+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2838390","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:35:08.6619716Z\",\"eventRecordID\":\"10311615\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:35:08.6619716Z","eventRecordID":"10311615","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.176+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":286,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2838390","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:48:05.8584019Z\",\"eventRecordID\":\"10311616\",\"processID\":\"416\",\"threadID\":\"18568\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:48:05.8584019Z","eventRecordID":"10311616","processID":"416","threadID":"18568","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.194+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2846499","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:48:05.8584180Z\",\"eventRecordID\":\"10311617\",\"processID\":\"416\",\"threadID\":\"18568\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:48:05.8584180Z","eventRecordID":"10311617","processID":"416","threadID":"18568","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.208+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":287,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2854610","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:52:45.2861038Z\",\"eventRecordID\":\"10311618\",\"processID\":\"416\",\"threadID\":\"11852\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:52:45.2861038Z","eventRecordID":"10311618","processID":"416","threadID":"11852","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.225+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2854610","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:52:45.2861372Z\",\"eventRecordID\":\"10311619\",\"processID\":\"416\",\"threadID\":\"11852\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:52:45.2861372Z","eventRecordID":"10311619","processID":"416","threadID":"11852","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.241+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":288,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2854610","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:32.9660144Z\",\"eventRecordID\":\"10311620\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:32.9660144Z","eventRecordID":"10311620","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.258+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2862721","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:32.9660382Z\",\"eventRecordID\":\"10311621\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:32.9660382Z","eventRecordID":"10311621","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.273+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":289,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2862721","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:35.1954906Z\",\"eventRecordID\":\"10311622\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:35.1954906Z","eventRecordID":"10311622","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.283+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2870832","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:35.1955056Z\",\"eventRecordID\":\"10311623\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:35.1955056Z","eventRecordID":"10311623","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.298+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":290,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2870832","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:35.5023827Z\",\"eventRecordID\":\"10311624\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:35.5023827Z","eventRecordID":"10311624","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.317+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2878943","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:35.5024049Z\",\"eventRecordID\":\"10311625\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:35.5024049Z","eventRecordID":"10311625","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.332+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":291,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2887054","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:36.2824180Z\",\"eventRecordID\":\"10311626\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:36.2824180Z","eventRecordID":"10311626","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.351+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2887054","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:36.2824334Z\",\"eventRecordID\":\"10311627\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:36.2824334Z","eventRecordID":"10311627","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.366+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":21,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2895165","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:37.8850911Z\",\"eventRecordID\":\"10311628\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x1009203F\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x1009203f\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:37.8850911Z","eventRecordID":"10311628","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x1009203F\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x1009203f","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.377+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2895165","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:37.8851134Z\",\"eventRecordID\":\"10311629\",\"processID\":\"416\",\"threadID\":\"10332\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x1009203F\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x1009203f\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:37.8851134Z","eventRecordID":"10311629","processID":"416","threadID":"10332","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x1009203F\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x1009203f","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.385+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":48,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2903359","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:39.1573748Z\",\"eventRecordID\":\"10311630\",\"processID\":\"4\",\"threadID\":\"20452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:39.1573748Z","eventRecordID":"10311630","processID":"4","threadID":"20452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.404+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":292,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2906788","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:39.1682459Z\",\"eventRecordID\":\"10311631\",\"processID\":\"416\",\"threadID\":\"5712\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:39.1682459Z","eventRecordID":"10311631","processID":"416","threadID":"5712","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.432+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2906788","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:39.1682620Z\",\"eventRecordID\":\"10311632\",\"processID\":\"416\",\"threadID\":\"5712\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:39.1682620Z","eventRecordID":"10311632","processID":"416","threadID":"5712","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.438+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":49,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2914897","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:39.1697845Z\",\"eventRecordID\":\"10311633\",\"processID\":\"4\",\"threadID\":\"20452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:39.1697845Z","eventRecordID":"10311633","processID":"4","threadID":"20452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.463+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":50,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2918122","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:58:45.5856550Z\",\"eventRecordID\":\"10311634\",\"processID\":\"4\",\"threadID\":\"7376\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\\r\\n\\r\\nNazwa urządzenia:\\t[TV][LG]55UB820V-ZH\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\\r\\n\\r\\nNazwa klasy:\\tDigitalMediaDevices\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUMB\\\\MS_DigitalMediaDeviceClass_DMR_V001\\r\\n\\t\\tSWD\\\\GenericRaw\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\thttp://192.168.1.114:1158/\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\DAFUPnPProvider\\\\\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\",\"deviceDescription\":\"[TV][LG]55UB820V-ZH\",\"classId\":\"{14b62f50-3f15-11dd-ae16-0800200c9a66}\",\"className\":\"DigitalMediaDevices\",\"compatibleIds\":\"    UMB\\\\\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\\\\\GenericRaw    SWD\\\\\\\\Generic\",\"locationInformation\":\"    http://192.168.1.114:1158/\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:58:45.5856550Z","eventRecordID":"10311634","processID":"4","threadID":"7376","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\DAFUPnPProvider\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe\r\n\r\nNazwa urządzenia:\t[TV][LG]55UB820V-ZH\r\n\r\nIdentyfikator klasy:\t\t{14b62f50-3f15-11dd-ae16-0800200c9a66}\r\n\r\nNazwa klasy:\tDigitalMediaDevices\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUMB\\MS_DigitalMediaDeviceClass_DMR_V001\r\n\t\tSWD\\GenericRaw\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\thttp://192.168.1.114:1158/\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\DAFUPnPProvider\\\\uuid:3270b0ae-0da8-b588-1579-bbe5f39ab9fe","deviceDescription":"[TV][LG]55UB820V-ZH","classId":"{14b62f50-3f15-11dd-ae16-0800200c9a66}","className":"DigitalMediaDevices","compatibleIds":"    UMB\\\\MS_DigitalMediaDeviceClass_DMR_V001    SWD\\\\GenericRaw    SWD\\\\Generic","locationInformation":"    http://192.168.1.114:1158/"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.475+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":293,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2918122","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:59:00.4542930Z\",\"eventRecordID\":\"10311635\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:59:00.4542930Z","eventRecordID":"10311635","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.495+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2921723","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T21:59:00.4543098Z\",\"eventRecordID\":\"10311636\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T21:59:00.4543098Z","eventRecordID":"10311636","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.512+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":294,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2929832","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:02:25.8344484Z\",\"eventRecordID\":\"10311637\",\"processID\":\"416\",\"threadID\":\"5712\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:02:25.8344484Z","eventRecordID":"10311637","processID":"416","threadID":"5712","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.528+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2929832","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:02:25.8344871Z\",\"eventRecordID\":\"10311638\",\"processID\":\"416\",\"threadID\":\"5712\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:02:25.8344871Z","eventRecordID":"10311638","processID":"416","threadID":"5712","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.542+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":295,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2929832","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:02:43.3553242Z\",\"eventRecordID\":\"10311639\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:02:43.3553242Z","eventRecordID":"10311639","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.560+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2937941","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:02:43.3553395Z\",\"eventRecordID\":\"10311640\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:02:43.3553395Z","eventRecordID":"10311640","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.574+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":296,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:06:06.6166805Z\",\"eventRecordID\":\"10311641\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:06:06.6166805Z","eventRecordID":"10311641","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.593+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:06:06.6167169Z\",\"eventRecordID\":\"10311642\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:06:06.6167169Z","eventRecordID":"10311642","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.600+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:07:24.5374145Z\",\"eventRecordID\":\"10311643\",\"processID\":\"416\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4e1c\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4e1c\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:07:24.5374145Z","eventRecordID":"10311643","processID":"416","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4e1c\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4e1c","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.626+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:07:24.5427194Z\",\"eventRecordID\":\"10311644\",\"processID\":\"416\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4e1c\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4e1c\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:07:24.5427194Z","eventRecordID":"10311644","processID":"416","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4e1c\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4e1c","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.626+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:07:24.7414554Z\",\"eventRecordID\":\"10311645\",\"processID\":\"416\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x42b8\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x42b8\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:07:24.7414554Z","eventRecordID":"10311645","processID":"416","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x42b8\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x42b8","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.653+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:07:24.7467476Z\",\"eventRecordID\":\"10311646\",\"processID\":\"416\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x42b8\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x42b8\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:07:24.7467476Z","eventRecordID":"10311646","processID":"416","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x42b8\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x42b8","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.656+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:07:25.2571658Z\",\"eventRecordID\":\"10311647\",\"processID\":\"416\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4a10\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4a10\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:07:25.2571658Z","eventRecordID":"10311647","processID":"416","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4a10\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4a10","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.693+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2946050","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:07:25.2623909Z\",\"eventRecordID\":\"10311648\",\"processID\":\"416\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4a10\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4a10\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:07:25.2623909Z","eventRecordID":"10311648","processID":"416","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4a10\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4a10","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.695+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":297,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2954159","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:09:51.1578363Z\",\"eventRecordID\":\"10311649\",\"processID\":\"416\",\"threadID\":\"16980\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:09:51.1578363Z","eventRecordID":"10311649","processID":"416","threadID":"16980","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.715+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2954159","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:09:51.1578519Z\",\"eventRecordID\":\"10311650\",\"processID\":\"416\",\"threadID\":\"16980\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:09:51.1578519Z","eventRecordID":"10311650","processID":"416","threadID":"16980","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.729+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":298,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2954159","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:18:17.6344520Z\",\"eventRecordID\":\"10311651\",\"processID\":\"416\",\"threadID\":\"17888\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:18:17.6344520Z","eventRecordID":"10311651","processID":"416","threadID":"17888","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.745+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2962270","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:18:17.6344871Z\",\"eventRecordID\":\"10311652\",\"processID\":\"416\",\"threadID\":\"17888\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:18:17.6344871Z","eventRecordID":"10311652","processID":"416","threadID":"17888","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.751+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2962270","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:18:18.0162688Z\",\"eventRecordID\":\"10311653\",\"processID\":\"416\",\"threadID\":\"17888\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-544\\r\\n\\tNazwa grupy:\\t\\tAdministratorzy\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3714\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administratorzy\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-544\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x3714\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:18:18.0162688Z","eventRecordID":"10311653","processID":"416","threadID":"17888","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-544\r\n\tNazwa grupy:\t\tAdministratorzy\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3714\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Administratorzy","targetDomainName":"Builtin","targetSid":"S-1-5-32-544","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x3714","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.760+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2962270","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:18:18.0173928Z\",\"eventRecordID\":\"10311654\",\"processID\":\"416\",\"threadID\":\"17888\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-551\\r\\n\\tNazwa grupy:\\t\\tOperatorzy kopii zapasowych\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3714\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Operatorzy kopii zapasowych\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-551\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x3714\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:18:18.0173928Z","eventRecordID":"10311654","processID":"416","threadID":"17888","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-551\r\n\tNazwa grupy:\t\tOperatorzy kopii zapasowych\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3714\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Operatorzy kopii zapasowych","targetDomainName":"Builtin","targetSid":"S-1-5-32-551","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x3714","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.782+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":299,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2962270","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:23:42.4138442Z\",\"eventRecordID\":\"10311655\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:23:42.4138442Z","eventRecordID":"10311655","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.810+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2970381","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:23:42.4138791Z\",\"eventRecordID\":\"10311656\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:23:42.4138791Z","eventRecordID":"10311656","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.824+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":300,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2970381","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:29.0068852Z\",\"eventRecordID\":\"10311657\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:29.0068852Z","eventRecordID":"10311657","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.842+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2978490","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:29.0069227Z\",\"eventRecordID\":\"10311658\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:29.0069227Z","eventRecordID":"10311658","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.856+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":301,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2978490","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:31.3853797Z\",\"eventRecordID\":\"10311659\",\"processID\":\"416\",\"threadID\":\"19128\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:31.3853797Z","eventRecordID":"10311659","processID":"416","threadID":"19128","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.868+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2986599","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:31.3853955Z\",\"eventRecordID\":\"10311660\",\"processID\":\"416\",\"threadID\":\"19128\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:31.3853955Z","eventRecordID":"10311660","processID":"416","threadID":"19128","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.881+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":302,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2986599","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:33.5042806Z\",\"eventRecordID\":\"10311661\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:33.5042806Z","eventRecordID":"10311661","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.903+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2994710","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:33.5042967Z\",\"eventRecordID\":\"10311662\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:33.5042967Z","eventRecordID":"10311662","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.918+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":22,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.2994710","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:35.8726168Z\",\"eventRecordID\":\"10311663\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x101BA996\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x101ba996\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:35.8726168Z","eventRecordID":"10311663","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x101BA996\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x101ba996","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.930+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.3002819","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:35.8726377Z\",\"eventRecordID\":\"10311664\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x101BA996\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x101ba996\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:35.8726377Z","eventRecordID":"10311664","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x101BA996\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x101ba996","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.946+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":303,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.3002819","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:35.9980149Z\",\"eventRecordID\":\"10311665\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:35.9980149Z","eventRecordID":"10311665","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.958+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.3011011","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:35.9980313Z\",\"eventRecordID\":\"10311666\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:35.9980313Z","eventRecordID":"10311666","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.973+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":51,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.3011011","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:37.0837896Z\",\"eventRecordID\":\"10311667\",\"processID\":\"4\",\"threadID\":\"12392\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:37.0837896Z","eventRecordID":"10311667","processID":"4","threadID":"12392","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:18.988+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":304,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315178.3022549","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:37.0949192Z\",\"eventRecordID\":\"10311668\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:37.0949192Z","eventRecordID":"10311668","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.013+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3022549","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:37.0949367Z\",\"eventRecordID\":\"10311669\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:37.0949367Z","eventRecordID":"10311669","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.020+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":52,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3030658","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:37.0965707Z\",\"eventRecordID\":\"10311670\",\"processID\":\"4\",\"threadID\":\"14084\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:37.0965707Z","eventRecordID":"10311670","processID":"4","threadID":"14084","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.034+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":305,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3030658","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:58.4725480Z\",\"eventRecordID\":\"10311671\",\"processID\":\"416\",\"threadID\":\"13316\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:58.4725480Z","eventRecordID":"10311671","processID":"416","threadID":"13316","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.047+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3033883","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:29:58.4725641Z\",\"eventRecordID\":\"10311672\",\"processID\":\"416\",\"threadID\":\"13316\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:29:58.4725641Z","eventRecordID":"10311672","processID":"416","threadID":"13316","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.065+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":306,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3033883","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:31:37.3920429Z\",\"eventRecordID\":\"10311673\",\"processID\":\"416\",\"threadID\":\"20288\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:31:37.3920429Z","eventRecordID":"10311673","processID":"416","threadID":"20288","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.083+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3041994","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:31:37.3920591Z\",\"eventRecordID\":\"10311674\",\"processID\":\"416\",\"threadID\":\"20288\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:31:37.3920591Z","eventRecordID":"10311674","processID":"416","threadID":"20288","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.098+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":307,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3050105","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:33:23.6636904Z\",\"eventRecordID\":\"10311675\",\"processID\":\"416\",\"threadID\":\"6452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:33:23.6636904Z","eventRecordID":"10311675","processID":"416","threadID":"6452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.123+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3050105","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:33:23.6637335Z\",\"eventRecordID\":\"10311676\",\"processID\":\"416\",\"threadID\":\"6452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:33:23.6637335Z","eventRecordID":"10311676","processID":"416","threadID":"6452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.138+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":308,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3058214","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:33:31.3015463Z\",\"eventRecordID\":\"10311677\",\"processID\":\"416\",\"threadID\":\"6452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:33:31.3015463Z","eventRecordID":"10311677","processID":"416","threadID":"6452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.156+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3058214","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:33:31.3015617Z\",\"eventRecordID\":\"10311678\",\"processID\":\"416\",\"threadID\":\"6452\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:33:31.3015617Z","eventRecordID":"10311678","processID":"416","threadID":"6452","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.169+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":309,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3058214","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:37:08.0876530Z\",\"eventRecordID\":\"10311679\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:37:08.0876530Z","eventRecordID":"10311679","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.180+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3066323","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:37:08.0876910Z\",\"eventRecordID\":\"10311680\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:37:08.0876910Z","eventRecordID":"10311680","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.196+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":310,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3074432","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:52:55.7186648Z\",\"eventRecordID\":\"10311681\",\"processID\":\"416\",\"threadID\":\"20168\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:52:55.7186648Z","eventRecordID":"10311681","processID":"416","threadID":"20168","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.209+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3074432","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:52:55.7186813Z\",\"eventRecordID\":\"10311682\",\"processID\":\"416\",\"threadID\":\"20168\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:52:55.7186813Z","eventRecordID":"10311682","processID":"416","threadID":"20168","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.225+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":311,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3074432","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:54:40.5052895Z\",\"eventRecordID\":\"10311683\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:54:40.5052895Z","eventRecordID":"10311683","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.248+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3082543","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-02T22:54:40.5053235Z\",\"eventRecordID\":\"10311684\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-02T22:54:40.5053235Z","eventRecordID":"10311684","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.254+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3082543","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:46.5142875Z\",\"eventRecordID\":\"10311685\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftOffice*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-11-21T08:08:52.9195886Z\",\"clientProcessId\":\"1452\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:46.5142875Z","eventRecordID":"10311685","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftOffice*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-11-21T08:08:52.9195886Z","clientProcessId":"1452"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.269+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":312,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3082543","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:46.5575176Z\",\"eventRecordID\":\"10311686\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:46.5575176Z","eventRecordID":"10311686","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.281+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3090652","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:46.5575642Z\",\"eventRecordID\":\"10311687\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:46.5575642Z","eventRecordID":"10311687","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.301+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":313,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3098763","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.0111081Z\",\"eventRecordID\":\"10311688\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.0111081Z","eventRecordID":"10311688","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.315+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3098763","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.0111310Z\",\"eventRecordID\":\"10311689\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.0111310Z","eventRecordID":"10311689","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.331+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":314,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3106872","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.1755325Z\",\"eventRecordID\":\"10311690\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.1755325Z","eventRecordID":"10311690","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.357+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3106872","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.1755599Z\",\"eventRecordID\":\"10311691\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.1755599Z","eventRecordID":"10311691","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.371+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":315,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3114981","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.2513811Z\",\"eventRecordID\":\"10311692\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.2513811Z","eventRecordID":"10311692","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.390+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3114981","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.2514020Z\",\"eventRecordID\":\"10311693\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.2514020Z","eventRecordID":"10311693","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.394+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3114981","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.4702668Z\",\"eventRecordID\":\"10311694\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-544\\r\\n\\tNazwa grupy:\\t\\tAdministratorzy\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x30cc\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administratorzy\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-544\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x30cc\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.4702668Z","eventRecordID":"10311694","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-544\r\n\tNazwa grupy:\t\tAdministratorzy\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x30cc\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Administratorzy","targetDomainName":"Builtin","targetSid":"S-1-5-32-544","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x30cc","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.407+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3114981","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:47.4712697Z\",\"eventRecordID\":\"10311695\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-551\\r\\n\\tNazwa grupy:\\t\\tOperatorzy kopii zapasowych\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x30cc\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Operatorzy kopii zapasowych\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-551\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x30cc\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:47.4712697Z","eventRecordID":"10311695","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-551\r\n\tNazwa grupy:\t\tOperatorzy kopii zapasowych\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x30cc\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Operatorzy kopii zapasowych","targetDomainName":"Builtin","targetSid":"S-1-5-32-551","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x30cc","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.424+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":316,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.7568934Z\",\"eventRecordID\":\"10311696\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.7568934Z","eventRecordID":"10311696","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.449+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.7569098Z\",\"eventRecordID\":\"10311697\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.7569098Z","eventRecordID":"10311697","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.456+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8211718Z\",\"eventRecordID\":\"10311698\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8211718Z","eventRecordID":"10311698","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.480+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8214090Z\",\"eventRecordID\":\"10311699\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8214090Z","eventRecordID":"10311699","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.484+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8214843Z\",\"eventRecordID\":\"10311700\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:target=virtualapp/didlogical\",\"type\":\"0\",\"countOfCredentialsReturned\":\"1\",\"readOperation\":\"%%8100\",\"returnCode\":\"0\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8214843Z","eventRecordID":"10311700","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:target=virtualapp/didlogical","type":"0","countOfCredentialsReturned":"1","readOperation":"%%8100","returnCode":"0","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.511+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8238352Z\",\"eventRecordID\":\"10311701\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8238352Z","eventRecordID":"10311701","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.515+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8239029Z\",\"eventRecordID\":\"10311702\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8239029Z","eventRecordID":"10311702","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.542+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8241537Z\",\"eventRecordID\":\"10311703\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8241537Z","eventRecordID":"10311703","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.547+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8569175Z\",\"eventRecordID\":\"10311704\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8569175Z","eventRecordID":"10311704","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.572+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8668435Z\",\"eventRecordID\":\"10311705\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8668435Z","eventRecordID":"10311705","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.577+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8671467Z\",\"eventRecordID\":\"10311706\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8671467Z","eventRecordID":"10311706","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.604+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8672405Z\",\"eventRecordID\":\"10311707\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:target=virtualapp/didlogical\",\"type\":\"0\",\"countOfCredentialsReturned\":\"1\",\"readOperation\":\"%%8100\",\"returnCode\":\"0\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8672405Z","eventRecordID":"10311707","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:target=virtualapp/didlogical","type":"0","countOfCredentialsReturned":"1","readOperation":"%%8100","returnCode":"0","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.607+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8918830Z\",\"eventRecordID\":\"10311708\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8918830Z","eventRecordID":"10311708","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.637+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8919592Z\",\"eventRecordID\":\"10311709\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8919592Z","eventRecordID":"10311709","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.640+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8922694Z\",\"eventRecordID\":\"10311710\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8922694Z","eventRecordID":"10311710","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.668+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.8971670Z\",\"eventRecordID\":\"10311711\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.8971670Z","eventRecordID":"10311711","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.671+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9266167Z\",\"eventRecordID\":\"10311712\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9266167Z","eventRecordID":"10311712","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.699+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9266948Z\",\"eventRecordID\":\"10311713\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9266948Z","eventRecordID":"10311713","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.703+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9270237Z\",\"eventRecordID\":\"10311714\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9270237Z","eventRecordID":"10311714","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.730+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9319917Z\",\"eventRecordID\":\"10311715\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9319917Z","eventRecordID":"10311715","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.733+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9766559Z\",\"eventRecordID\":\"10311716\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9766559Z","eventRecordID":"10311716","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.761+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9767312Z\",\"eventRecordID\":\"10311717\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9767312Z","eventRecordID":"10311717","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.764+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9770676Z\",\"eventRecordID\":\"10311718\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9770676Z","eventRecordID":"10311718","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.792+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3123092","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:49.9819220Z\",\"eventRecordID\":\"10311719\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:49.9819220Z","eventRecordID":"10311719","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.803+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":317,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3131201","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:50.0165721Z\",\"eventRecordID\":\"10311720\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:50.0165721Z","eventRecordID":"10311720","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.824+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3131201","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:50.0165885Z\",\"eventRecordID\":\"10311721\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:50.0165885Z","eventRecordID":"10311721","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.837+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":318,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3139310","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:50.9964887Z\",\"eventRecordID\":\"10311722\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:50.9964887Z","eventRecordID":"10311722","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.853+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3139310","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:50.9965056Z\",\"eventRecordID\":\"10311723\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:50.9965056Z","eventRecordID":"10311723","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.868+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":319,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3139310","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:50.9995444Z\",\"eventRecordID\":\"10311724\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:50.9995444Z","eventRecordID":"10311724","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.885+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:50.9995648Z\",\"eventRecordID\":\"10311725\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:50.9995648Z","eventRecordID":"10311725","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.892+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1455025Z\",\"eventRecordID\":\"10311726\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1455025Z","eventRecordID":"10311726","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.902+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1455829Z\",\"eventRecordID\":\"10311727\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1455829Z","eventRecordID":"10311727","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.923+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1459150Z\",\"eventRecordID\":\"10311728\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1459150Z","eventRecordID":"10311728","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.949+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1505930Z\",\"eventRecordID\":\"10311729\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1505930Z","eventRecordID":"10311729","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.955+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1886565Z\",\"eventRecordID\":\"10311730\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1886565Z","eventRecordID":"10311730","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.980+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1887312Z\",\"eventRecordID\":\"10311731\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1887312Z","eventRecordID":"10311731","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:19.984+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315179.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1890533Z\",\"eventRecordID\":\"10311732\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1890533Z","eventRecordID":"10311732","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.012+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3147421","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.1935765Z\",\"eventRecordID\":\"10311733\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.1935765Z","eventRecordID":"10311733","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.024+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":320,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.5072882Z\",\"eventRecordID\":\"10311734\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.5072882Z","eventRecordID":"10311734","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.043+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:51.5073041Z\",\"eventRecordID\":\"10311735\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:51.5073041Z","eventRecordID":"10311735","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.050+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:57.0820252Z\",\"eventRecordID\":\"10311736\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:57.0820252Z","eventRecordID":"10311736","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.078+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:57.0821020Z\",\"eventRecordID\":\"10311737\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:57.0821020Z","eventRecordID":"10311737","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.083+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:57.0824276Z\",\"eventRecordID\":\"10311738\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:57.0824276Z","eventRecordID":"10311738","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.110+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:57.7487514Z\",\"eventRecordID\":\"10311739\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:57.7487514Z","eventRecordID":"10311739","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.115+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:57.7504279Z\",\"eventRecordID\":\"10311740\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:57.7504279Z","eventRecordID":"10311740","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.141+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:57.7551952Z\",\"eventRecordID\":\"10311741\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:57.7551952Z","eventRecordID":"10311741","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.145+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:57.7552629Z\",\"eventRecordID\":\"10311742\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:57.7552629Z","eventRecordID":"10311742","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.167+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.2723164Z\",\"eventRecordID\":\"10311743\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"WindowsLive:(token):name=02vqsfkfxkhrzacq;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.2723164Z","eventRecordID":"10311743","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"WindowsLive:(token):name=02vqsfkfxkhrzacq;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.170+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.2725876Z\",\"eventRecordID\":\"10311744\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"WindowsLive:(cert):name=02vqsfkfxkhrzacq;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.2725876Z","eventRecordID":"10311744","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"WindowsLive:(cert):name=02vqsfkfxkhrzacq;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.198+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.2726907Z\",\"eventRecordID\":\"10311745\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"WindowsLive:target=virtualapp/didlogical\",\"type\":\"0\",\"countOfCredentialsReturned\":\"1\",\"readOperation\":\"%%8100\",\"returnCode\":\"0\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.2726907Z","eventRecordID":"10311745","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"WindowsLive:target=virtualapp/didlogical","type":"0","countOfCredentialsReturned":"1","readOperation":"%%8100","returnCode":"0","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.202+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.2746218Z\",\"eventRecordID\":\"10311746\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"MicrosoftAccount:user=02vqsfkfxkhrzacq\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.2746218Z","eventRecordID":"10311746","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"MicrosoftAccount:user=02vqsfkfxkhrzacq","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.229+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.2746930Z\",\"eventRecordID\":\"10311747\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"WindowsLive:(token):name=02vqsfkfxkhrzacq;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.2746930Z","eventRecordID":"10311747","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"WindowsLive:(token):name=02vqsfkfxkhrzacq;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.233+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3155532","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.2749707Z\",\"eventRecordID\":\"10311748\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"WindowsLive:(cert):name=02vqsfkfxkhrzacq;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.2749707Z","eventRecordID":"10311748","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"WindowsLive:(cert):name=02vqsfkfxkhrzacq;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.250+0000","rule":{"level":6,"description":"Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack.","id":"92652","mitre":{"id":["T1550.002"],"tactic":["Defense Evasion","Lateral Movement"],"technique":["Pass the Hash"]},"firedtimes":23,"mail":false,"groups":["win_evt_channel","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3163643","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.4356780Z\",\"eventRecordID\":\"10311749\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t3\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102EBC80\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x0\\r\\n\\tNazwa procesu:\\t\\t-\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tNBKPCSI556\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNtLmSsp \\r\\n\\tPakiet uwierzytelniania:\\tNTLM\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\tNTLM V2\\r\\n\\tDługość klucza:\\t\\t128\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102ebc80\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"NBKPCSI556\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"lmPackageName\":\"NTLM V2\",\"keyLength\":\"128\",\"processId\":\"0x0\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.4356780Z","eventRecordID":"10311749","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t3\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102EBC80\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x0\r\n\tNazwa procesu:\t\t-\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tNBKPCSI556\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNtLmSsp \r\n\tPakiet uwierzytelniania:\tNTLM\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\tNTLM V2\r\n\tDługość klucza:\t\t128\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102ebc80","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"NBKPCSI556","logonGuid":"{00000000-0000-0000-0000-000000000000}","lmPackageName":"NTLM V2","keyLength":"128","processId":"0x0","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.265+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3163643","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.4356983Z\",\"eventRecordID\":\"10311750\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-0-0\\r\\n\\tNazwa konta:\\t\\t-\\r\\n\\tDomena konta:\\t\\t-\\r\\n\\tIdentyfikator logowania:\\t\\t0x0\\r\\n\\r\\nTyp logowania:\\t\\t\\t3\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102EBC80\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-2}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-5-64-10}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102ebc80\",\"logonType\":\"3\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.4356983Z","eventRecordID":"10311750","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-0-0\r\n\tNazwa konta:\t\t-\r\n\tDomena konta:\t\t-\r\n\tIdentyfikator logowania:\t\t0x0\r\n\r\nTyp logowania:\t\t\t3\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102EBC80\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-2}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-5-64-10}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102ebc80","logonType":"3","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-2}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-5-64-10}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.278+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3163643","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.7167291Z\",\"eventRecordID\":\"10311751\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"MicrosoftAccount:user=02vqsfkfxkhrzacq\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.7167291Z","eventRecordID":"10311751","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"MicrosoftAccount:user=02vqsfkfxkhrzacq","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.293+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3163643","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.7208828Z\",\"eventRecordID\":\"10311752\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"MicrosoftAccount:user=02vqsfkfxkhrzacq\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.7208828Z","eventRecordID":"10311752","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"MicrosoftAccount:user=02vqsfkfxkhrzacq","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.309+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3163643","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.7241902Z\",\"eventRecordID\":\"10311753\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"MicrosoftAccount:user=02vqsfkfxkhrzacq\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.7241902Z","eventRecordID":"10311753","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"MicrosoftAccount:user=02vqsfkfxkhrzacq","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.339+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3163643","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.7242596Z\",\"eventRecordID\":\"10311754\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-19\\r\\n\\tNazwa konta:\\t\\tUSŁUGA LOKALNA\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E5\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-19\",\"subjectUserName\":\"USŁUGA LOKALNA\",\"subjectDomainName\":\"ZARZĄDZANIE NT\",\"subjectLogonId\":\"0x3e5\",\"targetName\":\"MicrosoftAccount:user=02vqsfkfxkhrzacq\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.7242596Z","eventRecordID":"10311754","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-19\r\n\tNazwa konta:\t\tUSŁUGA LOKALNA\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E5\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-19","subjectUserName":"USŁUGA LOKALNA","subjectDomainName":"ZARZĄDZANIE NT","subjectLogonId":"0x3e5","targetName":"MicrosoftAccount:user=02vqsfkfxkhrzacq","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.351+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":321,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3163643","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.8981868Z\",\"eventRecordID\":\"10311755\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.8981868Z","eventRecordID":"10311755","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.370+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3171837","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:58.8982114Z\",\"eventRecordID\":\"10311756\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:58.8982114Z","eventRecordID":"10311756","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.377+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":53,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3179946","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:59.0288408Z\",\"eventRecordID\":\"10311757\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&SessionId_0001\\r\\n\\r\\nNazwa urządzenia:\\tMicrosoft Remote Display Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e968-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDisplay\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tRdpIdd_IndirectDisplay\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\RemoteDisplayEnum\\\\\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001\",\"deviceDescription\":\"Microsoft Remote Display Adapter\",\"classId\":\"{4d36e968-e325-11ce-bfc1-08002be10318}\",\"className\":\"Display\",\"vendorIds\":\"    RdpIdd_IndirectDisplay\",\"compatibleIds\":\"    RdpIdd_IndirectDisplay    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:59.0288408Z","eventRecordID":"10311757","processID":"4","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001\r\n\r\nNazwa urządzenia:\tMicrosoft Remote Display Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e968-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDisplay\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tRdpIdd_IndirectDisplay\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\RemoteDisplayEnum\\\\RdpIdd_IndirectDisplay&amp;SessionId_0001","deviceDescription":"Microsoft Remote Display Adapter","classId":"{4d36e968-e325-11ce-bfc1-08002be10318}","className":"Display","vendorIds":"    RdpIdd_IndirectDisplay","compatibleIds":"    RdpIdd_IndirectDisplay    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.392+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":322,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3183375","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:59.0426822Z\",\"eventRecordID\":\"10311758\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:59.0426822Z","eventRecordID":"10311758","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.404+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3183375","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:59.0426986Z\",\"eventRecordID\":\"10311759\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:59.0426986Z","eventRecordID":"10311759","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.418+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":54,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3191484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:24:59.0440957Z\",\"eventRecordID\":\"10311760\",\"processID\":\"4\",\"threadID\":\"8416\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tDISPLAY\\\\Default_Monitor\\\\1&c528b8a&0&UID256\\r\\n\\r\\nNazwa urządzenia:\\tGeneric Non-PnP Monitor\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e96e-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tMonitor\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tMONITOR\\\\Default_Monitor\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\t*PNP09FF\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"DISPLAY\\\\\\\\Default_Monitor\\\\\\\\1&amp;c528b8a&amp;0&amp;UID256\",\"deviceDescription\":\"Generic Non-PnP Monitor\",\"classId\":\"{4d36e96e-e325-11ce-bfc1-08002be10318}\",\"className\":\"Monitor\",\"vendorIds\":\"    MONITOR\\\\\\\\Default_Monitor\",\"compatibleIds\":\"    *PNP09FF\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:24:59.0440957Z","eventRecordID":"10311760","processID":"4","threadID":"8416","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tDISPLAY\\Default_Monitor\\1&c528b8a&0&UID256\r\n\r\nNazwa urządzenia:\tGeneric Non-PnP Monitor\r\n\r\nIdentyfikator klasy:\t\t{4d36e96e-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tMonitor\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tMONITOR\\Default_Monitor\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\t*PNP09FF\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"DISPLAY\\\\Default_Monitor\\\\1&amp;c528b8a&amp;0&amp;UID256","deviceDescription":"Generic Non-PnP Monitor","classId":"{4d36e96e-e325-11ce-bfc1-08002be10318}","className":"Monitor","vendorIds":"    MONITOR\\\\Default_Monitor","compatibleIds":"    *PNP09FF"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.437+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3191484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4648\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:00.9236435Z\",\"eventRecordID\":\"10311761\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Podjęto próbę logowania przy użyciu jawnych poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\tS-1-5-18\\r\\n\\tNazwa konta:\\tWRKPCSI150$\\r\\n\\tDomena konta:\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t0x3E7\\r\\n\\tIdentyfikator GUID logowania:\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nKonto, którego poświadczenia zostały użyte:\\r\\n\\tNazwa konta:\\tajupa\\r\\n\\tDomena konta:\\tPENTACOMP\\r\\n\\tIdentyfikator GUID logowania:\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nSerwer docelowy:\\r\\n\\tNazwa serwera docelowego:\\tlocalhost\\r\\n\\tInformacje dodatkowe:\\tlocalhost\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t0x3a8\\r\\n\\tNazwa procesu:\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tAdres sieciowy:\\t192.168.1.104\\r\\n\\tPort:\\t0\\r\\n\\r\\nTo zdarzenie jest generowane, gdy proces podejmie próbę zalogowania się na koncie, określając w sposób jawny poświadczenia konta. To zdarzenie najczęściej występuje w konfiguracjach wsadowych, takich jak zaplanowane zadania, lub podczas używania polecenia RUNAS.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetServerName\":\"localhost\",\"targetInfo\":\"localhost\",\"processId\":\"0x3a8\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4648","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:00.9236435Z","eventRecordID":"10311761","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Podjęto próbę logowania przy użyciu jawnych poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\tS-1-5-18\r\n\tNazwa konta:\tWRKPCSI150$\r\n\tDomena konta:\tPENTACOMP\r\n\tIdentyfikator logowania:\t0x3E7\r\n\tIdentyfikator GUID logowania:\t{00000000-0000-0000-0000-000000000000}\r\n\r\nKonto, którego poświadczenia zostały użyte:\r\n\tNazwa konta:\tajupa\r\n\tDomena konta:\tPENTACOMP\r\n\tIdentyfikator GUID logowania:\t{00000000-0000-0000-0000-000000000000}\r\n\r\nSerwer docelowy:\r\n\tNazwa serwera docelowego:\tlocalhost\r\n\tInformacje dodatkowe:\tlocalhost\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t0x3a8\r\n\tNazwa procesu:\tC:\\Windows\\System32\\svchost.exe\r\n\r\nInformacje o sieci:\r\n\tAdres sieciowy:\t192.168.1.104\r\n\tPort:\t0\r\n\r\nTo zdarzenie jest generowane, gdy proces podejmie próbę zalogowania się na koncie, określając w sposób jawny poświadczenia konta. To zdarzenie najczęściej występuje w konfiguracjach wsadowych, takich jak zaplanowane zadania, lub podczas używania polecenia RUNAS.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","logonGuid":"{00000000-0000-0000-0000-000000000000}","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonGuid":"{00000000-0000-0000-0000-000000000000}","targetServerName":"localhost","targetInfo":"localhost","processId":"0x3a8","processName":"C:\\\\Windows\\\\System32\\\\svchost.exe","ipAddress":"192.168.1.104","ipPort":"0"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.455+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3191484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:00.9236637Z\",\"eventRecordID\":\"10311762\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t7\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102F8D19\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x102F8F42\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3a8\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tWRKPCSI150\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tUser32 \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102f8d19\",\"logonType\":\"7\",\"logonProcessName\":\"User32\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"PC15\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3a8\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x102f8f42\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:00.9236637Z","eventRecordID":"10311762","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t7\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102F8D19\r\n\tPołączony identyfikator logowania:\t\t0x102F8F42\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3a8\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tWRKPCSI150\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tUser32 \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102f8d19","logonType":"7","logonProcessName":"User32","authenticationPackageName":"Negotiate","workstationName":"PC15","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3a8","processName":"C:\\\\Windows\\\\System32\\\\svchost.exe","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x102f8f42","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.468+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3191484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:00.9236852Z\",\"eventRecordID\":\"10311763\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t7\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102F8D19\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-14}\\r\\n\\t\\t%{S-1-5-4}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-2-0}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102f8d19\",\"logonType\":\"7\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-2-0}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:00.9236852Z","eventRecordID":"10311763","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t7\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102F8D19\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-14}\r\n\t\t%{S-1-5-4}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-2-0}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102f8d19","logonType":"7","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-2-0}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.485+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3191484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:00.9237049Z\",\"eventRecordID\":\"10311764\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t7\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tNie\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102F8F42\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x102F8D19\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3a8\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tWRKPCSI150\\r\\n\\tŹródłowy adres sieciowy:\\t192.168.1.104\\r\\n\\tPort źródłowy:\\t\\t0\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tUser32 \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102f8f42\",\"logonType\":\"7\",\"logonProcessName\":\"User32\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"PC15\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3a8\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\",\"ipAddress\":\"192.168.1.104\",\"ipPort\":\"0\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x102f8d19\",\"elevatedToken\":\"%%1843\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:00.9237049Z","eventRecordID":"10311764","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t7\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tNie\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102F8F42\r\n\tPołączony identyfikator logowania:\t\t0x102F8D19\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3a8\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tWRKPCSI150\r\n\tŹródłowy adres sieciowy:\t192.168.1.104\r\n\tPort źródłowy:\t\t0\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tUser32 \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102f8f42","logonType":"7","logonProcessName":"User32","authenticationPackageName":"Negotiate","workstationName":"PC15","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3a8","processName":"C:\\\\Windows\\\\System32\\\\svchost.exe","ipAddress":"192.168.1.104","ipPort":"0","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x102f8d19","elevatedToken":"%%1843"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.497+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3191484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:00.9237215Z\",\"eventRecordID\":\"10311765\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t7\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102F8F42\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-14}\\r\\n\\t\\t%{S-1-5-4}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-2-0}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-16-8192}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102f8f42\",\"logonType\":\"7\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-2-0}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-8192}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:00.9237215Z","eventRecordID":"10311765","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t7\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102F8F42\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-14}\r\n\t\t%{S-1-5-4}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-2-0}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-16-8192}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102f8f42","logonType":"7","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-2-0}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-8192}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.518+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3191484","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4648\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:01.2573183Z\",\"eventRecordID\":\"10311766\",\"processID\":\"416\",\"threadID\":\"4384\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Podjęto próbę logowania przy użyciu jawnych poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\tS-1-5-18\\r\\n\\tNazwa konta:\\tWRKPCSI150$\\r\\n\\tDomena konta:\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t0x3E7\\r\\n\\tIdentyfikator GUID logowania:\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nKonto, którego poświadczenia zostały użyte:\\r\\n\\tNazwa konta:\\tajupa\\r\\n\\tDomena konta:\\tPENTACOMP\\r\\n\\tIdentyfikator GUID logowania:\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nSerwer docelowy:\\r\\n\\tNazwa serwera docelowego:\\tlocalhost\\r\\n\\tInformacje dodatkowe:\\tlocalhost\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t0x1a0\\r\\n\\tNazwa procesu:\\tC:\\\\Windows\\\\System32\\\\lsass.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tAdres sieciowy:\\t-\\r\\n\\tPort:\\t-\\r\\n\\r\\nTo zdarzenie jest generowane, gdy proces podejmie próbę zalogowania się na koncie, określając w sposób jawny poświadczenia konta. To zdarzenie najczęściej występuje w konfiguracjach wsadowych, takich jak zaplanowane zadania, lub podczas używania polecenia RUNAS.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"targetServerName\":\"localhost\",\"targetInfo\":\"localhost\",\"processId\":\"0x1a0\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4648","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:01.2573183Z","eventRecordID":"10311766","processID":"416","threadID":"4384","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Podjęto próbę logowania przy użyciu jawnych poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\tS-1-5-18\r\n\tNazwa konta:\tWRKPCSI150$\r\n\tDomena konta:\tPENTACOMP\r\n\tIdentyfikator logowania:\t0x3E7\r\n\tIdentyfikator GUID logowania:\t{00000000-0000-0000-0000-000000000000}\r\n\r\nKonto, którego poświadczenia zostały użyte:\r\n\tNazwa konta:\tajupa\r\n\tDomena konta:\tPENTACOMP\r\n\tIdentyfikator GUID logowania:\t{00000000-0000-0000-0000-000000000000}\r\n\r\nSerwer docelowy:\r\n\tNazwa serwera docelowego:\tlocalhost\r\n\tInformacje dodatkowe:\tlocalhost\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t0x1a0\r\n\tNazwa procesu:\tC:\\Windows\\System32\\lsass.exe\r\n\r\nInformacje o sieci:\r\n\tAdres sieciowy:\t-\r\n\tPort:\t-\r\n\r\nTo zdarzenie jest generowane, gdy proces podejmie próbę zalogowania się na koncie, określając w sposób jawny poświadczenia konta. To zdarzenie najczęściej występuje w konfiguracjach wsadowych, takich jak zaplanowane zadania, lub podczas używania polecenia RUNAS.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","logonGuid":"{00000000-0000-0000-0000-000000000000}","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonGuid":"{00000000-0000-0000-0000-000000000000}","targetServerName":"localhost","targetInfo":"localhost","processId":"0x1a0","processName":"C:\\\\Windows\\\\System32\\\\lsass.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.536+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":323,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3194707","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:01.2573429Z\",\"eventRecordID\":\"10311767\",\"processID\":\"416\",\"threadID\":\"4384\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t7\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102F93C6\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x102FA05A\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x1a0\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\lsass.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tWRKPCSI150\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNegotiat\\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102f93c6\",\"logonType\":\"7\",\"logonProcessName\":\"Negotiat\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"PC15\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x1a0\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x102fa05a\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:01.2573429Z","eventRecordID":"10311767","processID":"416","threadID":"4384","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t7\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102F93C6\r\n\tPołączony identyfikator logowania:\t\t0x102FA05A\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x1a0\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\lsass.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tWRKPCSI150\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNegotiat\r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102f93c6","logonType":"7","logonProcessName":"Negotiat","authenticationPackageName":"Negotiate","workstationName":"PC15","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x1a0","processName":"C:\\\\Windows\\\\System32\\\\lsass.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x102fa05a","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.545+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3194707","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:01.2573714Z\",\"eventRecordID\":\"10311768\",\"processID\":\"416\",\"threadID\":\"4384\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t7\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102F93C6\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-14}\\r\\n\\t\\t%{S-1-5-4}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-16-12288}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102f93c6\",\"logonType\":\"7\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-12288}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:01.2573714Z","eventRecordID":"10311768","processID":"416","threadID":"4384","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t7\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102F93C6\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-14}\r\n\t\t%{S-1-5-4}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-16-12288}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102f93c6","logonType":"7","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-12288}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.566+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":324,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:01.2573933Z\",\"eventRecordID\":\"10311769\",\"processID\":\"416\",\"threadID\":\"4384\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t7\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tNie\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102FA05A\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x102F93C6\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x1a0\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\lsass.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\tWRKPCSI150\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tNegotiat\\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102fa05a\",\"logonType\":\"7\",\"logonProcessName\":\"Negotiat\",\"authenticationPackageName\":\"Negotiate\",\"workstationName\":\"PC15\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x1a0\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\lsass.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x102f93c6\",\"elevatedToken\":\"%%1843\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:01.2573933Z","eventRecordID":"10311769","processID":"416","threadID":"4384","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t7\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tNie\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102FA05A\r\n\tPołączony identyfikator logowania:\t\t0x102F93C6\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x1a0\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\lsass.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\tWRKPCSI150\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tNegotiat\r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102fa05a","logonType":"7","logonProcessName":"Negotiat","authenticationPackageName":"Negotiate","workstationName":"PC15","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x1a0","processName":"C:\\\\Windows\\\\System32\\\\lsass.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x102f93c6","elevatedToken":"%%1843"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.574+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:01.2574108Z\",\"eventRecordID\":\"10311770\",\"processID\":\"416\",\"threadID\":\"4384\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t7\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x102FA05A\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-513}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-5-32-556}\\r\\n\\t\\t%{S-1-5-32-545}\\r\\n\\t\\t%{S-1-5-14}\\r\\n\\t\\t%{S-1-5-4}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-5-15}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21524}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21801}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22446}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14015}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20727}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-20726}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-22548}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-23477}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-14563}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21558}\\r\\n\\t\\t%{S-1-18-1}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-1163}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-19983}\\r\\n\\t\\t%{S-1-5-21-507921405-362288127-725345543-21095}\\r\\n\\t\\t%{S-1-16-8192}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"targetUserName\":\"user1\",\"targetDomainName\":\"DOMAIN\",\"targetLogonId\":\"0x102fa05a\",\"logonType\":\"7\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-8192}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:01.2574108Z","eventRecordID":"10311770","processID":"416","threadID":"4384","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t7\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x102FA05A\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-513}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-5-32-556}\r\n\t\t%{S-1-5-32-545}\r\n\t\t%{S-1-5-14}\r\n\t\t%{S-1-5-4}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-5-15}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21524}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21801}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22446}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14015}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20727}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-20726}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-22548}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-23477}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-14563}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21558}\r\n\t\t%{S-1-18-1}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-1163}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-19983}\r\n\t\t%{S-1-5-21-507921405-362288127-725345543-21095}\r\n\t\t%{S-1-16-8192}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-21-507921405-362288127-725345543-23289","targetUserName":"user1","targetDomainName":"DOMAIN","targetLogonId":"0x102fa05a","logonType":"7","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-21-507921405-362288127-725345543-513}    %{S-1-1-0}    %{S-1-5-32-544}    %{S-1-5-32-556}    %{S-1-5-32-545}    %{S-1-5-14}    %{S-1-5-4}    %{S-1-5-11}    %{S-1-5-15}    %{S-1-5-21-507921405-362288127-725345543-21524}    %{S-1-5-21-507921405-362288127-725345543-21801}    %{S-1-5-21-507921405-362288127-725345543-22446}    %{S-1-5-21-507921405-362288127-725345543-14015}    %{S-1-5-21-507921405-362288127-725345543-20727}    %{S-1-5-21-507921405-362288127-725345543-20726}    %{S-1-5-21-507921405-362288127-725345543-22548}    %{S-1-5-21-507921405-362288127-725345543-23477}    %{S-1-5-21-507921405-362288127-725345543-14563}    %{S-1-5-21-507921405-362288127-725345543-21558}    %{S-1-18-1}    %{S-1-5-21-507921405-362288127-725345543-1163}    %{S-1-5-21-507921405-362288127-725345543-19983}    %{S-1-5-21-507921405-362288127-725345543-21095}    %{S-1-16-8192}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.590+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:16.9699519Z\",\"eventRecordID\":\"10311771\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:16.9699519Z","eventRecordID":"10311771","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.611+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:16.9700664Z\",\"eventRecordID\":\"10311772\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:16.9700664Z","eventRecordID":"10311772","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.624+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:16.9706255Z\",\"eventRecordID\":\"10311773\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:16.9706255Z","eventRecordID":"10311773","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.651+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:17.3678966Z\",\"eventRecordID\":\"10311774\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:17.3678966Z","eventRecordID":"10311774","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.655+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:17.3732741Z\",\"eventRecordID\":\"10311775\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:17.3732741Z","eventRecordID":"10311775","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.683+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:17.3802051Z\",\"eventRecordID\":\"10311776\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:17.3802051Z","eventRecordID":"10311776","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.686+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:17.3803277Z\",\"eventRecordID\":\"10311777\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:17.3803277Z","eventRecordID":"10311777","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.713+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:20.2952494Z\",\"eventRecordID\":\"10311778\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:20.2952494Z","eventRecordID":"10311778","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.717+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:20.2953275Z\",\"eventRecordID\":\"10311779\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:20.2953275Z","eventRecordID":"10311779","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.744+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:20.2956892Z\",\"eventRecordID\":\"10311780\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:20.2956892Z","eventRecordID":"10311780","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.749+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:20.6422243Z\",\"eventRecordID\":\"10311781\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:20.6422243Z","eventRecordID":"10311781","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.776+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:20.6461365Z\",\"eventRecordID\":\"10311782\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:20.6461365Z","eventRecordID":"10311782","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.782+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:20.6494212Z\",\"eventRecordID\":\"10311783\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:20.6494212Z","eventRecordID":"10311783","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.808+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3203063","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:20.6494940Z\",\"eventRecordID\":\"10311784\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:20.6494940Z","eventRecordID":"10311784","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.819+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":325,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:38.3184346Z\",\"eventRecordID\":\"10311785\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:38.3184346Z","eventRecordID":"10311785","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.838+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:38.3184559Z\",\"eventRecordID\":\"10311786\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:38.3184559Z","eventRecordID":"10311786","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.844+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6422\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:38.4207194Z\",\"eventRecordID\":\"10311787\",\"processID\":\"4\",\"threadID\":\"18408\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Urządzenie zostało włączone. \\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tROOT\\\\NET\\\\0001\\r\\n\\r\\nNazwa urządzenia:\\tFortinet SSL VPN Virtual Ethernet Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e972-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tNet\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\troot\\\\ftsvnic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"ROOT\\\\\\\\NET\\\\\\\\0001\",\"deviceDescription\":\"Fortinet SSL VPN Virtual Ethernet Adapter\",\"classId\":\"{4d36e972-e325-11ce-bfc1-08002be10318}\",\"className\":\"Net\",\"hardwareIds\":\"    root\\\\\\\\ftsvnic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6422","version":"0","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:38.4207194Z","eventRecordID":"10311787","processID":"4","threadID":"18408","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Urządzenie zostało włączone. \r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tROOT\\NET\\0001\r\n\r\nNazwa urządzenia:\tFortinet SSL VPN Virtual Ethernet Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e972-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tNet\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\troot\\ftsvnic\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"ROOT\\\\NET\\\\0001","deviceDescription":"Fortinet SSL VPN Virtual Ethernet Adapter","classId":"{4d36e972-e325-11ce-bfc1-08002be10318}","className":"Net","hardwareIds":"    root\\\\ftsvnic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.870+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6420\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:38.4207852Z\",\"eventRecordID\":\"10311788\",\"processID\":\"4\",\"threadID\":\"18408\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Urządzenie zostało wyłączone. \\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tROOT\\\\NET\\\\0001\\r\\n\\r\\nNazwa urządzenia:\\tFortinet SSL VPN Virtual Ethernet Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e972-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tNet\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\troot\\\\ftsvnic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"ROOT\\\\\\\\NET\\\\\\\\0001\",\"deviceDescription\":\"Fortinet SSL VPN Virtual Ethernet Adapter\",\"classId\":\"{4d36e972-e325-11ce-bfc1-08002be10318}\",\"className\":\"Net\",\"hardwareIds\":\"    root\\\\\\\\ftsvnic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6420","version":"0","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:38.4207852Z","eventRecordID":"10311788","processID":"4","threadID":"18408","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Urządzenie zostało wyłączone. \r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tROOT\\NET\\0001\r\n\r\nNazwa urządzenia:\tFortinet SSL VPN Virtual Ethernet Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e972-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tNet\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\troot\\ftsvnic\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"ROOT\\\\NET\\\\0001","deviceDescription":"Fortinet SSL VPN Virtual Ethernet Adapter","classId":"{4d36e972-e325-11ce-bfc1-08002be10318}","className":"Net","hardwareIds":"    root\\\\ftsvnic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.873+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6421\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:39.2334724Z\",\"eventRecordID\":\"10311789\",\"processID\":\"3184\",\"threadID\":\"5496\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Zażądano włączenia urządzenia. \\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tROOT\\\\NET\\\\0001\\r\\n\\r\\nNazwa urządzenia:\\tFortinet SSL VPN Virtual Ethernet Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e972-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tNet\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\troot\\\\ftsvnic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"ROOT\\\\\\\\NET\\\\\\\\0001\",\"deviceDescription\":\"Fortinet SSL VPN Virtual Ethernet Adapter\",\"classId\":\"{4d36e972-e325-11ce-bfc1-08002be10318}\",\"className\":\"Net\",\"hardwareIds\":\"    root\\\\\\\\ftsvnic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6421","version":"0","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:39.2334724Z","eventRecordID":"10311789","processID":"3184","threadID":"5496","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Zażądano włączenia urządzenia. \r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tROOT\\NET\\0001\r\n\r\nNazwa urządzenia:\tFortinet SSL VPN Virtual Ethernet Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e972-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tNet\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\troot\\ftsvnic\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"ROOT\\\\NET\\\\0001","deviceDescription":"Fortinet SSL VPN Virtual Ethernet Adapter","classId":"{4d36e972-e325-11ce-bfc1-08002be10318}","className":"Net","hardwareIds":"    root\\\\ftsvnic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.901+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6422\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:25:39.2339539Z\",\"eventRecordID\":\"10311790\",\"processID\":\"4\",\"threadID\":\"18408\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Urządzenie zostało włączone. \\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tROOT\\\\NET\\\\0001\\r\\n\\r\\nNazwa urządzenia:\\tFortinet SSL VPN Virtual Ethernet Adapter\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e972-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tNet\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\troot\\\\ftsvnic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"ROOT\\\\\\\\NET\\\\\\\\0001\",\"deviceDescription\":\"Fortinet SSL VPN Virtual Ethernet Adapter\",\"classId\":\"{4d36e972-e325-11ce-bfc1-08002be10318}\",\"className\":\"Net\",\"hardwareIds\":\"    root\\\\\\\\ftsvnic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6422","version":"0","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:25:39.2339539Z","eventRecordID":"10311790","processID":"4","threadID":"18408","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Urządzenie zostało włączone. \r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tROOT\\NET\\0001\r\n\r\nNazwa urządzenia:\tFortinet SSL VPN Virtual Ethernet Adapter\r\n\r\nIdentyfikator klasy:\t\t{4d36e972-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tNet\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\troot\\ftsvnic\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"ROOT\\\\NET\\\\0001","deviceDescription":"Fortinet SSL VPN Virtual Ethernet Adapter","classId":"{4d36e972-e325-11ce-bfc1-08002be10318}","className":"Net","hardwareIds":"    root\\\\ftsvnic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:20.901+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"type\":\"summary\",\"scan_id\":1936076184,\"name\":\"CIS Benchmark for Windows 10 Enterprise (Release 21H2)\",\"policy_id\":\"cis_win10_enterprise\",\"file\":\"cis_win10_enterprise.yml\",\"description\":\"This document provides prescriptive guidance for establishing a secure configuration posture for Microsoft Windows 10.\",\"references\":\"https://www.cisecurity.org/cis-benchmarks/\",\"passed\":121,\"failed\":271,\"invalid\":3,\"total_checks\":395,\"score\":30.867347717285156,\"start_time\":1670018840,\"end_time\":1670018867,\"hash\":\"4af810c1208a54a1d7ae655946e5c94a68760f8deb89dce0a6b0b75e46a902f7\",\"hash_file\":\"ef6f119bfa6ba4b4a6b75207f1fa40231b6353948772d5c4407128f3b57279c4\"}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T08:26:20.963+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315180.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DNS-Client\",\"providerGuid\":\"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}\",\"eventID\":\"8018\",\"version\":\"0\",\"level\":\"3\",\"task\":\"1028\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-06T08:26:06.0229915Z\",\"eventRecordID\":\"10778\",\"processID\":\"1716\",\"threadID\":\"8048\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\\r\\no ustawieniach:\\r\\n\\r\\n   Nazwa karty: {31B7F03B-075B-4AE9-B869-B1CAC885D171}\\r\\n   Nazwa hosta: PC15\\r\\n   Sufiks domeny podstawowej: DOMAIN.pl\\r\\n   Lista serwerów DNS:\\r\\n     \\t192.168.60.162, 192.168.60.154\\r\\n   Aktualizacja wysłana do serwera: 192.168.60.162:53\\r\\n   Adresy IP:\\r\\n     192.168.136.90\\r\\n\\r\\n System nie może zarejestrować tych rekordów RR z powodu odrzucenia żądania aktualizacji przez serwer DNS, z którym się kontaktowano. Mogło to nastąpić, ponieważ: (a) nie można aktualizować określonej nazwy domeny DNS lub (b) serwer DNS autorytatywny dla tej nazwy nie obsługuje protokołu aktualizacji dynamicznych DNS.\\r\\n\\r\\n Aby zarejestrować rekordy zasobu hosta DNS (A lub AAAA) przy użyciu określonej nazwy domeny DNS i adresów IP dla tej karty, skontaktuj się z administratorem systemów sieciowych lub serwera DNS.\\\"\"},\"eventdata\":{\"adapterName\":\"{31B7F03B-075B-4AE9-B869-B1CAC885D171}\",\"hostName\":\"PC15\",\"adapterSuffixName\":\"DOMAIN.pl\",\"dnsServerList\":\"\\\\t192.168.60.162, 192.168.60.154\",\"sent UpdateServer\":\"192.168.60.162:53\",\"ipaddress\":\"192.168.136.90\",\"errorCode\":\"9005\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DNS-Client","providerGuid":"{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}","eventID":"8018","version":"0","level":"3","task":"1028","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-06T08:26:06.0229915Z","eventRecordID":"10778","processID":"1716","threadID":"8048","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"System nie może zarejestrować rekordów zasobu (RR) hosta (A lub AAAA) dla karty sieciowej\r\no ustawieniach:\r\n\r\n   Nazwa karty: {31B7F03B-075B-4AE9-B869-B1CAC885D171}\r\n   Nazwa hosta: PC15\r\n   Sufiks domeny podstawowej: DOMAIN.pl\r\n   Lista serwerów DNS:\r\n     \t192.168.60.162, 192.168.60.154\r\n   Aktualizacja wysłana do serwera: 192.168.60.162:53\r\n   Adresy IP:\r\n     192.168.136.90\r\n\r\n System nie może zarejestrować tych rekordów RR z powodu odrzucenia żądania aktualizacji przez serwer DNS, z którym się kontaktowano. Mogło to nastąpić, ponieważ: (a) nie można aktualizować określonej nazwy domeny DNS lub (b) serwer DNS autorytatywny dla tej nazwy nie obsługuje protokołu aktualizacji dynamicznych DNS.\r\n\r\n Aby zarejestrować rekordy zasobu hosta DNS (A lub AAAA) przy użyciu określonej nazwy domeny DNS i adresów IP dla tej karty, skontaktuj się z administratorem systemów sieciowych lub serwera DNS.\""},"eventdata":{"adapterName":"{31B7F03B-075B-4AE9-B869-B1CAC885D171}","hostName":"PC15","adapterSuffixName":"DOMAIN.pl","dnsServerList":"\\t192.168.60.162, 192.168.60.154","sent UpdateServer":"192.168.60.162:53","ipaddress":"192.168.136.90","errorCode":"9005"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:21.021+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"Ending rootcheck scan.","decoder":{"name":"rootcheck"},"data":{"title":"Ending rootcheck scan."},"location":"rootcheck"}
{"timestamp":"2022-12-06T08:26:21.097+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"type\":\"policies\",\"policies\":[\"cis_win10_enterprise\",\"sca_win_audit\"]}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T08:26:21.097+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"type\":\"summary\",\"scan_id\":1280578773,\"name\":\"Benchmark for Windows audit\",\"policy_id\":\"sca_win_audit\",\"file\":\"sca_win_audit.yml\",\"description\":\"This document provides a way of ensuring the security of the Windows systems.\",\"passed\":25,\"failed\":10,\"invalid\":36,\"total_checks\":71,\"score\":71.428573608398438,\"start_time\":1670315163,\"end_time\":1670315167,\"hash\":\"cb0d30af3623879dc21a6dc698ce3df73bb4446268619a8aae6e00f8b2b98731\",\"hash_file\":\"da409ead5682c644e5bf9b99c91fc1c1bbc439126696ed406a7c932bc9d5c499\"}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T08:26:21.166+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:26:14.8414676Z\",\"eventRecordID\":\"10311791\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4c08\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4c08\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:26:14.8414676Z","eventRecordID":"10311791","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4c08\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4c08","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:21.170+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:26:14.8471072Z\",\"eventRecordID\":\"10311792\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4c08\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4c08\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:26:14.8471072Z","eventRecordID":"10311792","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4c08\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4c08","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:21.198+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:26:15.0608775Z\",\"eventRecordID\":\"10311793\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3a48\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x3a48\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:26:15.0608775Z","eventRecordID":"10311793","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3a48\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x3a48","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:21.200+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:26:15.0667725Z\",\"eventRecordID\":\"10311794\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3a48\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x3a48\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:26:15.0667725Z","eventRecordID":"10311794","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3a48\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x3a48","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:21.230+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:26:15.6075240Z\",\"eventRecordID\":\"10311795\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4a08\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4a08\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:26:15.6075240Z","eventRecordID":"10311795","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4a08\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4a08","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:21.230+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315181.3211419","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4798\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:26:15.6128379Z\",\"eventRecordID\":\"10311796\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nUżytkownik:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-781888883-2267942692-155982675-500\\r\\n\\tNazwa konta:\\t\\tAdministrator\\r\\n\\tDomena konta:\\t\\tWRKPCSI150\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4a08\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administrator\",\"targetDomainName\":\"PC15\",\"targetSid\":\"S-1-5-21-781888883-2267942692-155982675-500\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4a08\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4798","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:26:15.6128379Z","eventRecordID":"10311796","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej użytkownika zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nUżytkownik:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-781888883-2267942692-155982675-500\r\n\tNazwa konta:\t\tAdministrator\r\n\tDomena konta:\t\tWRKPCSI150\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4a08\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administrator","targetDomainName":"PC15","targetSid":"S-1-5-21-781888883-2267942692-155982675-500","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4a08","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:42.929+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315202.3211419","full_log":"{\"type\":\"summary\",\"scan_id\":734303622,\"name\":\"CIS Benchmark for Windows 10 Enterprise (Release 21H2)\",\"policy_id\":\"cis_win10_enterprise\",\"file\":\"cis_win10_enterprise.yml\",\"description\":\"This document provides prescriptive guidance for establishing a secure configuration posture for Microsoft Windows 10.\",\"references\":\"https://www.cisecurity.org/cis-benchmarks/\",\"passed\":121,\"failed\":271,\"invalid\":3,\"total_checks\":395,\"score\":30.867347717285156,\"start_time\":1670315170,\"end_time\":1670315200,\"hash\":\"4af810c1208a54a1d7ae655946e5c94a68760f8deb89dce0a6b0b75e46a902f7\",\"hash_file\":\"ef6f119bfa6ba4b4a6b75207f1fa40231b6353948772d5c4407128f3b57279c4\"}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T08:26:47.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","full_log":"ossec: output: 'df -P': Filesystem     1024-blocks    Used Available Capacity Mounted on","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:26:47.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","full_log":"ossec: output: 'df -P': devtmpfs           4079480       0   4079480       0% /dev","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:26:47.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","full_log":"ossec: output: 'df -P': tmpfs              4086932      60   4086872       1% /dev/shm","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:26:47.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","full_log":"ossec: output: 'df -P': tmpfs              4086932   33540   4053392       1% /run","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:26:47.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","full_log":"ossec: output: 'df -P': tmpfs              4086932       0   4086932       0% /sys/fs/cgroup","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:26:47.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","full_log":"ossec: output: 'df -P': tmpfs               817388       0    817388       0% /run/user/1000","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:26:47.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","full_log":"ossec: output: 'df -P': /dev/sda1         52407300 7803736  44603564      15% /","decoder":{"name":"ossec"},"location":"df -P"}
{"timestamp":"2022-12-06T08:26:47.950+0000","rule":{"level":1,"description":"List of the last logged in users.","id":"535","firedtimes":5,"mail":false,"groups":["ossec"],"pci_dss":["10.6.1"],"hipaa":["164.312.b"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315207.3211419","previous_output":"Previous output:\nossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.52   Tue Dec  6 08:16   still logged in   \nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:20 (17+21:40)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwtmp begins Wed Jun  1 08:31:54 2022","full_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.52   Tue Dec  6 08:16   still logged in   \nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:26 (17+21:46)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwtmp begins Wed Jun  1 08:31:54 2022","decoder":{"name":"ossec"},"previous_log":"ossec: output: 'last -n 20':\nwazuh-us pts/0        192.168.136.52   Tue Dec  6 08:16   still logged in   \nwazuh-us pts/0        192.168.136.59   Fri Dec  2 10:08 - 13:13  (03:04)    \nwazuh-us pts/0        192.168.136.117  Thu Dec  1 08:06 - 15:17  (07:11)    \nwazuh-us pts/0        192.168.136.97   Thu Dec  1 07:49 - 07:58  (00:09)    \nwazuh-us pts/0        192.168.136.88   Thu Nov 24 07:45 - 21:57  (14:11)    \nwazuh-us pts/0        192.168.136.136  Wed Nov 23 10:52 - 00:03  (13:11)    \nwazuh-us pts/0        192.168.136.163  Tue Nov 22 10:37 - 12:54  (02:17)    \nwazuh-us pts/0        192.168.136.14   Tue Nov 22 07:49 - 10:33  (02:43)    \nwazuh-us pts/0        192.168.136.90   Mon Nov 21 08:12 - 21:24  (13:11)    \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 10:42 - 16:54  (06:11)    \nreboot   system boot  3.10.0-1160.76.1 Fri Nov 18 10:40 - 08:20 (17+21:40)  \nwazuh-us pts/0        192.168.136.129  Fri Nov 18 09:16 - 10:40  (01:23)    \nwazuh-us pts/0        192.168.136.85   Thu Oct 27 10:54 - 00:06  (13:11)    \nwazuh-us pts/0        192.168.136.114  Thu Oct 27 07:31 - 10:31  (03:00)    \nwazuh-us pts/0        192.168.136.23   Wed Oct 26 12:30 - 19:41  (07:11)    \nwazuh-us pts/0        192.168.136.15   Wed Oct 26 06:06 - 11:52  (05:45)    \nwazuh-us pts/0        192.168.136.142  Tue Oct 25 13:58 - 21:09  (07:11)    \nwazuh-us pts/0        192.168.136.9    Fri Oct 21 06:10 - 16:10  (10:00)    \nwazuh-us pts/0        192.168.136.129  Thu Oct 20 07:44 - 10:05  (02:21)    \nwazuh-us pts/0        192.168.136.55   Wed Oct 19 13:41 - 17:53  (04:11)    \nwtmp begins Wed Jun  1 08:31:54 2022","location":"last -n 20"}
{"timestamp":"2022-12-06T08:26:49.799+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315209.3211419","full_log":"{\"type\":\"summary\",\"scan_id\":158792404,\"name\":\"Benchmark for Windows audit\",\"policy_id\":\"sca_win_audit\",\"file\":\"sca_win_audit.yml\",\"description\":\"This document provides a way of ensuring the security of the Windows systems.\",\"passed\":25,\"failed\":10,\"invalid\":36,\"total_checks\":71,\"score\":71.428573608398438,\"start_time\":1670315203,\"end_time\":1670315207,\"hash\":\"cb0d30af3623879dc21a6dc698ce3df73bb4446268619a8aae6e00f8b2b98731\",\"hash_file\":\"da409ead5682c644e5bf9b99c91fc1c1bbc439126696ed406a7c932bc9d5c499\"}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T08:26:49.946+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":1,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315209.3211419","full_log":"Dec  6 08:26:48 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:26:48Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:48","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:49.946+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":2,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315209.3211419","full_log":"Dec  6 08:26:48 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:26:48Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:48","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:50.155+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315210.3211419","full_log":"{\"type\":\"policies\",\"policies\":[\"cis_win10_enterprise\",\"sca_win_audit\"]}","decoder":{"name":"sca"},"location":"sca"}
{"timestamp":"2022-12-06T08:26:51.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"logo default config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"mark default config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"favicon config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"loadingLogo default config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.948+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":302,\"req\":{\"url\":\"/\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"sec-fetch-site\":\"none\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-user\":\"?1\",\"sec-fetch-dest\":\"document\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\"},\"res\":{\"statusCode\":302,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET / 302 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/app/login?nextUrl=%2F\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"sec-fetch-site\":\"none\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-user\":\"?1\",\"sec-fetch-dest\":\"document\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\"},\"res\":{\"statusCode\":200,\"responseTime\":31,\"contentLength\":9},\"message\":\"GET /app/login?nextUrl=%2F 200 31ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"api\"],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/bootstrap.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":23,\"contentLength\":9},\"message\":\"GET /bootstrap.js 200 23ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":3,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":4,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":5,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":6,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":7,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:50 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:50","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/alertingDashboards/alertingDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/alertingDashboards/alertingDashboards.plugin.js 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/usageCollection/usageCollection.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/usageCollection/usageCollection.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsUtils/opensearchDashboardsUtils.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsUtils/opensearchDashboardsUtils.plugin.js 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/core/core.entry.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":438,\"contentLength\":9},\"message\":\"GET /1/bundles/core/core.entry.js 200 438ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsLegacy/opensearchDashboardsLegacy.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsLegacy/opensearchDashboardsLegacy.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/urlForwarding/urlForwarding.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/urlForwarding/urlForwarding.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:51.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315211.3211419","full_log":"Dec  6 08:26:51 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/devTools/devTools.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/devTools/devTools.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:51","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:52 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:52Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/mapsLegacy/mapsLegacy.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/mapsLegacy/mapsLegacy.plugin.js 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:52","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:52 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:50Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.@elastic.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1758,\"contentLength\":9},\"message\":\"GET /1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.@elastic.js 200 1758ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:52","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:52 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:52Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon-32x32.png\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon-32x32.png 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:52","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:52 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:52Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsReact/opensearchDashboardsReact.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsReact/opensearchDashboardsReact.plugin.js 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:52","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:52 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:52Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/charts/charts.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/charts/charts.plugin.js 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:52","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/bfetch/bfetch.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/bfetch/bfetch.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/share/share.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/share/share.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.949+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:52 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:52Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visDefaultEditor/visDefaultEditor.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visDefaultEditor/visDefaultEditor.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:52","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/inspector/inspector.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/inspector/inspector.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/uiActions/uiActions.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/uiActions/uiActions.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:52Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/data/data.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":334,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/data/data.plugin.js 200 334ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/savedObjects/savedObjects.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/savedObjects/savedObjects.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/expressions/expressions.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/expressions/expressions.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/home/home.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/home/home.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchUiShared/opensearchUiShared.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchUiShared/opensearchUiShared.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:53.950+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315213.3211419","full_log":"Dec  6 08:26:53 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:53Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/embeddable/embeddable.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/embeddable/embeddable.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:53","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3211419","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/console/console.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/console/console.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3211419","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/management/management.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/management/management.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3211419","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/indexPatternManagement/indexPatternManagement.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/indexPatternManagement/indexPatternManagement.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3211419","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/advancedSettings/advancedSettings.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/advancedSettings/advancedSettings.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3211419","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/apmOss/apmOss.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/apmOss/apmOss.plugin.js 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/navigation/navigation.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/navigation/navigation.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/securityDashboards/securityDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/securityDashboards/securityDashboards.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/indexManagementDashboards/indexManagementDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/indexManagementDashboards/indexManagementDashboards.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.952+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/reportsDashboards/reportsDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/reportsDashboards/reportsDashboards.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/dashboard/dashboard.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/dashboard/dashboard.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:51Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3830,\"contentLength\":9},\"message\":\"GET /1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.js 200 3830ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:54 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:54Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visualizations/visualizations.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visualizations/visualizations.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:54","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/discover/discover.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/discover/discover.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeVislib/visTypeVislib.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeVislib/visTypeVislib.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeVega/visTypeVega.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":11,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeVega/visTypeVega.plugin.js 200 11ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTimeseries/visTypeTimeseries.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTimeseries/visTypeTimeseries.plugin.js 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTimeline/visTypeTimeline.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTimeline/visTypeTimeline.plugin.js 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/timeline/timeline.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/timeline/timeline.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeMarkdown/visTypeMarkdown.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeMarkdown/visTypeMarkdown.plugin.js 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTagcloud/visTypeTagcloud.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTagcloud/visTypeTagcloud.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeMetric/visTypeMetric.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeMetric/visTypeMetric.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTable/visTypeTable.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTable/visTypeTable.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/tileMap/tileMap.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/tileMap/tileMap.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/inputControlVis/inputControlVis.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/inputControlVis/inputControlVis.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:55.953+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315215.3219530","full_log":"Dec  6 08:26:55 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/regionMap/regionMap.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/regionMap/regionMap.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:55","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:57.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315217.3219530","full_log":"Dec  6 08:26:57 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:55Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/ganttChartDashboards/ganttChartDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1811,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/ganttChartDashboards/ganttChartDashboards.plugin.js 200 1811ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:57","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:57.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315217.3219530","full_log":"Dec  6 08:26:56 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:56Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visualize/visualize.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visualize/visualize.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:56","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:57.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315217.3219530","full_log":"Dec  6 08:26:56 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:56Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsOverview/opensearchDashboardsOverview.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsOverview/opensearchDashboardsOverview.plugin.js 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:56","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:57.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315217.3219530","full_log":"Dec  6 08:26:56 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:56Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:56","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:57.954+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315217.3219530","full_log":"Dec  6 08:26:56 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:56Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/savedObjectsManagement/savedObjectsManagement.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/savedObjectsManagement/savedObjectsManagement.plugin.js 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:56","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:58.635+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":8,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315218.3219530","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:26:58.5684980Z\",\"eventRecordID\":\"10779\",\"processID\":\"1012\",\"threadID\":\"7716\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"autostart\",\"param3\":\"uruchamianie na żądanie\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:26:58.5684980Z","eventRecordID":"10779","processID":"1012","threadID":"7716","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z autostart na uruchamianie na żądanie.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"autostart","param3":"uruchamianie na żądanie","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.css\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"text/css,*/*;q=0.1\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"style\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.css 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/node_modules/@osd/ui-framework/dist/kui_light.css\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"text/css,*/*;q=0.1\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"style\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /node_modules/@osd/ui-framework/dist/kui_light.css 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":401,\"req\":{\"url\":\"/api/v1/configuration/account\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":401,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /api/v1/configuration/account 401 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.v7.light.css\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"text/css,*/*;q=0.1\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"style\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.v7.light.css 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/translations/en.json\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /translations/en.json 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/core/capabilities\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"293\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"POST /api/core/capabilities 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/legacy_light_theme.css\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"text/css,*/*;q=0.1\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"style\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/legacy_light_theme.css 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":401,\"req\":{\"url\":\"/api/v1/restapiinfo\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":401,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /api/v1/restapiinfo 401 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/fonts/inter_ui/Inter-UI-Regular.woff2\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/fonts/inter_ui/Inter-UI-Regular.woff2 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/wazuh_wazuh_bg.svg\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/ui/legacy_light_theme.css\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/ui/legacy_light_theme.css\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/wazuh_wazuh_bg.svg 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":401,\"req\":{\"url\":\"/api/v1/configuration/account\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":401,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /api/v1/configuration/account 401 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/securityDashboards/securityDashboards.chunk.5.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/securityDashboards/securityDashboards.chunk.5.js 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsLegacy/opensearchDashboardsLegacy.chunk.1.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsLegacy/opensearchDashboardsLegacy.chunk.1.js 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:26:59.957+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315219.3219727","full_log":"Dec  6 08:26:58 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:26:58Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/Wazuh-Logo.svg\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/Wazuh-Logo.svg 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:26:58","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"logo default config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"mark default config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"favicon config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":302,\"req\":{\"url\":\"/\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-user\":\"?1\",\"sec-fetch-dest\":\"document\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":302,\"responseTime\":15,\"contentLength\":9},\"message\":\"GET / 302 15ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[\"info\",\"branding\"],\"pid\":460,\"message\":\"loadingLogo default config is not found or invalid.\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/core/core.entry.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/core/core.entry.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/app/wazuh\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-user\":\"?1\",\"sec-fetch-dest\":\"document\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":28,\"contentLength\":9},\"message\":\"GET /app/wazuh 200 28ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[\"api\"],\"pid\":460,\"method\":\"get\",\"statusCode\":304,\"req\":{\"url\":\"/bootstrap.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"if-none-match\":\"\\\"e074341dbadedba69e0a9b51aaed2c808925e692-gzip\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":304,\"responseTime\":24,\"contentLength\":9},\"message\":\"GET /bootstrap.js 304 24ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/alertingDashboards/alertingDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/alertingDashboards/alertingDashboards.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/usageCollection/usageCollection.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/usageCollection/usageCollection.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsUtils/opensearchDashboardsUtils.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":7,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsUtils/opensearchDashboardsUtils.plugin.js 200 7ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsLegacy/opensearchDashboardsLegacy.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsLegacy/opensearchDashboardsLegacy.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/auth/login\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"39\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/login?nextUrl=%2F\"},\"res\":{\"statusCode\":200,\"responseTime\":29,\"contentLength\":9},\"message\":\"POST /auth/login 200 29ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:05.964+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315225.3219727","full_log":"Dec  6 08:27:05 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/urlForwarding/urlForwarding.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/urlForwarding/urlForwarding.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:05","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:06Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/devTools/devTools.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/devTools/devTools.plugin.js 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:06Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/mapsLegacy/mapsLegacy.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/mapsLegacy/mapsLegacy.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:06Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchDashboardsReact/opensearchDashboardsReact.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchDashboardsReact/opensearchDashboardsReact.plugin.js 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:06Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visDefaultEditor/visDefaultEditor.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visDefaultEditor/visDefaultEditor.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:06Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/data/data.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/data/data.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:06Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/inspector/inspector.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/inspector/inspector.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.@elastic.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":1467,\"contentLength\":9},\"message\":\"GET /1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.@elastic.js 200 1467ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/bfetch/bfetch.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/bfetch/bfetch.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/share/share.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/share/share.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/uiActions/uiActions.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/uiActions/uiActions.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.966+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:06 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:06Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/charts/charts.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/charts/charts.plugin.js 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:06","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/embeddable/embeddable.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/embeddable/embeddable.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/opensearchUiShared/opensearchUiShared.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/opensearchUiShared/opensearchUiShared.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/expressions/expressions.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/expressions/expressions.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/savedObjects/savedObjects.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/savedObjects/savedObjects.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:07.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315227.3219727","full_log":"Dec  6 08:27:07 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:07Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/home/home.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/home/home.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:07","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/indexPatternManagement/indexPatternManagement.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/indexPatternManagement/indexPatternManagement.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/console/console.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/console/console.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/advancedSettings/advancedSettings.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/advancedSettings/advancedSettings.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/navigation/navigation.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/navigation/navigation.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/dashboard/dashboard.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/dashboard/dashboard.plugin.js 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/reportsDashboards/reportsDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":8,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/reportsDashboards/reportsDashboards.plugin.js 200 8ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/indexManagementDashboards/indexManagementDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/indexManagementDashboards/indexManagementDashboards.plugin.js 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/securityDashboards/securityDashboards.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":11,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/securityDashboards/securityDashboards.plugin.js 200 11ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visualizations/visualizations.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visualizations/visualizations.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/discover/discover.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/discover/discover.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeVislib/visTypeVislib.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeVislib/visTypeVislib.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeVega/visTypeVega.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeVega/visTypeVega.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTimeseries/visTypeTimeseries.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTimeseries/visTypeTimeseries.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTimeline/visTypeTimeline.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTimeline/visTypeTimeline.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/timeline/timeline.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/timeline/timeline.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTagcloud/visTypeTagcloud.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTagcloud/visTypeTagcloud.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeTable/visTypeTable.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeTable/visTypeTable.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.968+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:09 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:09Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeMarkdown/visTypeMarkdown.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeMarkdown/visTypeMarkdown.plugin.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:09","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/apmOss/apmOss.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/apmOss/apmOss.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:09.967+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315229.3219727","full_log":"Dec  6 08:27:08 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:08Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/management/management.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/management/management.plugin.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:08","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/inputControlVis/inputControlVis.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/inputControlVis/inputControlVis.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeMetric/visTypeMetric.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeMetric/visTypeMetric.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:05Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4969,\"contentLength\":9},\"message\":\"GET /1/bundles/osd-ui-shared-deps/osd-ui-shared-deps.js 200 4969ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/translations/en.json\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /translations/en.json 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/tileMap/tileMap.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/tileMap/tileMap.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/node_modules/@osd/ui-framework/dist/kui_light.css\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"text/css,*/*;q=0.1\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"style\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /node_modules/@osd/ui-framework/dist/kui_light.css 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/legacy_light_theme.css\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"text/css,*/*;q=0.1\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"style\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /ui/legacy_light_theme.css 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/fonts/inter_ui/Inter-UI-Regular.woff2\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/fonts/inter_ui/Inter-UI-Regular.woff2 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/v1/configuration/account\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":13,\"contentLength\":9},\"message\":\"GET /api/v1/configuration/account 200 13ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/v1/configuration/account\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /api/v1/configuration/account 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/core/capabilities\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"322\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"POST /api/core/capabilities 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.31.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.31.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.5.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.5.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/fonts/inter_ui/Inter-UI-Medium.woff2\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/fonts/inter_ui/Inter-UI-Medium.woff2 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/default_branding/opensearch_logo.svg\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/default_branding/opensearch_logo.svg 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/regionMap/regionMap.plugin.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/regionMap/regionMap.plugin.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.4.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.4.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:10 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:10Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/v1/restapiinfo\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":7,\"contentLength\":9},\"message\":\"GET /api/v1/restapiinfo 200 7ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:10","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:11.970+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315231.3219727","full_log":"Dec  6 08:27:11 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:11Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.13.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.13.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:11","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:13.972+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315233.3219727","full_log":"Dec  6 08:27:13 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:12Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.10.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":755,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.10.js 200 755ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:13","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:13.972+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315233.3219727","full_log":"Dec  6 08:27:12 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:12Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.6.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.6.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:12","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:13.972+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315233.3219727","full_log":"Dec  6 08:27:12 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:12Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/check-wazuh\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /api/check-wazuh 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:12","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.974+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/security/current-platform\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /elastic/security/current-platform 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.974+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:14 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:12Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.9.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2087,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.9.js 200 2087ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:14","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.974+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.25.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.25.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/plugins/wazuh/assets/images/themes/light/logo.svg\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /plugins/wazuh/assets/images/themes/light/logo.svg 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":16,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 16ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.974+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/wazuh.chunk.23.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/wazuh.chunk.23.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_bulk_get\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"48\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":15,\"contentLength\":9},\"message\":\"POST /api/saved_objects/_bulk_get 200 15ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/setup\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /api/setup 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_bulk_get\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"48\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":11,\"contentLength\":9},\"message\":\"POST /api/saved_objects/_bulk_get 200 11ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?type=index-pattern&fields=title&fields=fields&per_page=9999\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":16,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?type=index-pattern&fields=title&fields=fields&per_page=9999 200 16ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.975+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/index-pattern/wazuh-monitoring-*?fields=title&fields=fields\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":8,\"contentLength\":9},\"message\":\"GET /api/saved_objects/index-pattern/wazuh-monitoring-*?fields=title&fields=fields 200 8ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/plugins/wazuh/assets/images/themes/light/logo.svg\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /plugins/wazuh/assets/images/themes/light/logo.svg 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:15.976+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315235.3219727","full_log":"Dec  6 08:27:15 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/index-pattern/wazuh-statistics-*?fields=title&fields=fields\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /api/saved_objects/index-pattern/wazuh-statistics-*?fields=title&fields=fields 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:15","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":37,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 37ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":8,\"contentLength\":9},\"message\":\"GET /api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields 200 8ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":37,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 37ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":13,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 13ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":16,\"contentLength\":9},\"message\":\"GET /api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields 200 16ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/template/wazuh-alerts-*\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":8,\"contentLength\":9},\"message\":\"GET /elastic/template/wazuh-alerts-* 200 8ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/index_patterns/_fields_for_wildcard?pattern=wazuh-alerts-%2A&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":87,\"contentLength\":9},\"message\":\"GET /api/index_patterns/_fields_for_wildcard?pattern=wazuh-alerts-%2A&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score 200 87ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/login\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"34\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":1054,\"contentLength\":9},\"message\":\"POST /api/login 200 1054ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/check-stored-api\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"16\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":1103,\"contentLength\":9},\"message\":\"POST /api/check-stored-api 200 1103ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:15Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/check-stored-api\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"16\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":936,\"contentLength\":9},\"message\":\"POST /api/check-stored-api 200 936ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:17 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:17Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/fonts/roboto_mono/RobotoMono-Regular.ttf\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":12,\"contentLength\":9},\"message\":\"GET /ui/fonts/roboto_mono/RobotoMono-Regular.ttf 200 12ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:17","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"96\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":18,\"contentLength\":9},\"message\":\"POST /api/request 200 18ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:16 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":75,\"contentLength\":9},\"message\":\"GET /api/saved_objects/index-pattern/wazuh-alerts-*?fields=title&fields=fields 200 75ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:16","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:17 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:17Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/fonts/inter_ui/Inter-UI-SemiBold.woff2\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/fonts/inter_ui/Inter-UI-SemiBold.woff2 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:17","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:17 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:17Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/setup\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /api/setup 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:17","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:17.978+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315237.3219727","full_log":"Dec  6 08:27:17 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:17Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"52\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":17,\"contentLength\":9},\"message\":\"POST /api/request 200 17ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:17","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.980+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:16Z\",\"tags\":[],\"pid\":460,\"method\":\"put\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/index-pattern/wazuh-alerts-*\",\"method\":\"put\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"101799\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":1518,\"contentLength\":9},\"message\":\"PUT /api/saved_objects/index-pattern/wazuh-alerts-* 200 1518ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":12,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 12ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.980+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/data/data.chunk.0.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/data/data.chunk.0.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/extensions/default\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /api/extensions/default 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/data/data.chunk.8.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/data/data.chunk.8.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/extensions\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"236\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":6,\"contentLength\":9},\"message\":\"POST /api/extensions 200 6ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":32,\"contentLength\":9},\"message\":\"POST /api/request 200 32ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/data/data.chunk.4.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/data/data.chunk.4.js 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/extensions/default\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /api/extensions/default 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/extensions\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"236\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":7,\"contentLength\":9},\"message\":\"POST /api/extensions 200 7ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/fonts/inter_ui/Inter-UI-Light-BETA.woff2\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/fonts/inter_ui/Inter-UI-Light-BETA.woff2 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/fonts/inter_ui/Inter-UI-Bold.woff2\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/fonts/inter_ui/Inter-UI-Bold.woff2 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/data/data.chunk.7.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/data/data.chunk.7.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":25,\"contentLength\":9},\"message\":\"POST /api/request 200 25ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:19.981+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315239.3219727","full_log":"Dec  6 08:27:18 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:18Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:18","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.982+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.982+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":10,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 10ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.982+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":20,\"contentLength\":9},\"message\":\"POST /api/request 200 20ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"131\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":41,\"contentLength\":9},\"message\":\"POST /api/request 200 41ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":32,\"contentLength\":9},\"message\":\"POST /api/request 200 32ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"52\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":25,\"contentLength\":9},\"message\":\"POST /api/request 200 25ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/visualizations/overview-general/wazuh-alerts-*\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":10,\"contentLength\":9},\"message\":\"GET /elastic/visualizations/overview-general/wazuh-alerts-* 200 10ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"52\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":27,\"contentLength\":9},\"message\":\"POST /api/request 200 27ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"58\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":31,\"contentLength\":9},\"message\":\"POST /api/request 200 31ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/top/manager/wazuh-server/agent.name/wazuh-alerts-*?agentsList=\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":43,\"contentLength\":9},\"message\":\"GET /elastic/top/manager/wazuh-server/agent.name/wazuh-alerts-*?agentsList= 200 43ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/wazuh/e6cf7c6ec7c2d6f670ae9d762604cb0b.woff2\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"font\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/wazuh/e6cf7c6ec7c2d6f670ae9d762604cb0b.woff2 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"110\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":25,\"contentLength\":9},\"message\":\"POST /api/request 200 25ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":21,\"contentLength\":9},\"message\":\"POST /api/request 200 21ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/top/manager/wazuh-server/agent.id/wazuh-alerts-*?agentsList=\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":33,\"contentLength\":9},\"message\":\"GET /elastic/top/manager/wazuh-server/agent.id/wazuh-alerts-*?agentsList= 200 33ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/data/data.chunk.5.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":8,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/data/data.chunk.5.js 200 8ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:21 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"84\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":30,\"contentLength\":9},\"message\":\"POST /api/request 200 30ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:21","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:20 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:20Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"79\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":27,\"contentLength\":9},\"message\":\"POST /api/request 200 27ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:20","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:21 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:21Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1580\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":71,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 71ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:21","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:21 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:21Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"58\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":31,\"contentLength\":9},\"message\":\"POST /api/request 200 31ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:21","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:21 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:21Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"736\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":48,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 48ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:21","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:21 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:21Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeVislib/visTypeVislib.chunk.1.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeVislib/visTypeVislib.chunk.1.js 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:21","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:21 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:21Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/1/bundles/plugin/visTypeVislib/visTypeVislib.chunk.2.js\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"script\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /1/bundles/plugin/visTypeVislib/visTypeVislib.chunk.2.js 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:21","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:21.983+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315241.3219727","full_log":"Dec  6 08:27:21 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:21Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_bulk_get\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"52\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":12,\"contentLength\":9},\"message\":\"POST /api/saved_objects/_bulk_get 200 12ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:21","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:23.985+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315243.3219727","full_log":"Dec  6 08:27:23 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:23Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:23","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:23.985+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315243.3219727","full_log":"Dec  6 08:27:23 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:23Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:23","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:23.985+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315243.3219727","full_log":"Dec  6 08:27:23 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:23Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":7,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 7ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:23","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:23.985+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315243.3219727","full_log":"Dec  6 08:27:23 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:23Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"88\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":30,\"contentLength\":9},\"message\":\"POST /api/request 200 30ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:23","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:23.985+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315243.3219727","full_log":"Dec  6 08:27:23 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:23Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:23","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:23.985+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315243.3219727","full_log":"Dec  6 08:27:23 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:23Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":13,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 13ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:23","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"58\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":38,\"contentLength\":9},\"message\":\"POST /api/request 200 38ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"94\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":37,\"contentLength\":9},\"message\":\"POST /api/request 200 37ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/visualizations/agents-welcome/wazuh-alerts-*\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":7,\"contentLength\":9},\"message\":\"GET /elastic/visualizations/agents-welcome/wazuh-alerts-* 200 7ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"52\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":23,\"contentLength\":9},\"message\":\"POST /api/request 200 23ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"350\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":64,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 64ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"370\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":41,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 41ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"371\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":38,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 38ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1348\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":74,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 74ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1626\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":90,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 90ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":10,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 10ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":22,\"contentLength\":9},\"message\":\"POST /api/request 200 22ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":24,\"contentLength\":9},\"message\":\"POST /api/request 200 24ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.987+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/visualizations/agents-fim/wazuh-alerts-*\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /elastic/visualizations/agents-fim/wazuh-alerts-* 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:25.986+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315245.3219727","full_log":"Dec  6 08:27:24 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:24Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:24","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1257\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":81,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 81ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:25 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:25Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:25","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1387\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":74,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 74ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1307\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":64,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 64ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1251\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":154,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 154ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1306\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":93,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 93ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1374\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":74,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 74ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":61,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 61ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1339\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":146,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 146ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1567\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":100,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 100ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1420\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":86,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 86ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1500\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":124,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 124ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1364\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":147,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 147ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1419\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":68,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 68ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1680\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":74,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 74ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1452\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":64,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 64ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1370\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":82,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 82ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.989+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":8,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:27.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315247.3219727","full_log":"Dec  6 08:27:26 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:26Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1487\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":87,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 87ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:26","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:28 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:28Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:28","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:28 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:28Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1660\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":70,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 70ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:28","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:28 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:28Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:28","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:28Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"87\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":74,\"contentLength\":9},\"message\":\"POST /api/request 200 74ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:28 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:28Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1407\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":72,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 72ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:28","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":10,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 10ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:28 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:28Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"110\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":24,\"contentLength\":9},\"message\":\"POST /api/request 200 24ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:28","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.989+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:28 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:28Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"116\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":44,\"contentLength\":9},\"message\":\"POST /api/request 200 44ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:28","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"58\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":31,\"contentLength\":9},\"message\":\"POST /api/request 200 31ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"88\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":41,\"contentLength\":9},\"message\":\"POST /api/request 200 41ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":9,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":10,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"370\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":44,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 44ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"52\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":21,\"contentLength\":9},\"message\":\"POST /api/request 200 21ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"350\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":84,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 84ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"371\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":68,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 68ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"94\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":38,\"contentLength\":9},\"message\":\"POST /api/request 200 38ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/visualizations/agents-welcome/wazuh-alerts-*\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /elastic/visualizations/agents-welcome/wazuh-alerts-* 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:29.990+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315249.3219727","full_log":"Dec  6 08:27:29 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:29Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:29","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.992+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.992+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:30 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:30Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1348\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":76,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 76ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:30","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.992+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:30 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:30Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1626\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":87,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 87ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:30","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.992+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.992+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":13,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 13ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":10,\"contentLength\":9},\"message\":\"GET /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern 200 10ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":1,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 1ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.992+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":3,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 3ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":7,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 7ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/utils/configuration\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /utils/configuration 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/hosts/apis\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /hosts/apis 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"281\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":47,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 47ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":56,\"contentLength\":9},\"message\":\"POST /api/request 200 56ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.993+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:31 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:31Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/api/request\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"73\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":26,\"contentLength\":9},\"message\":\"POST /api/request 200 26ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:31","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:31.992+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315251.3219727","full_log":"Dec  6 08:27:30 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:30Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":2,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 2ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:30","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":4,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 4ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1253\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":111,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 111ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":11,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":12,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/visualizations/agents-general/wazuh-alerts-*\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":9,\"contentLength\":9},\"message\":\"GET /elastic/visualizations/agents-general/wazuh-alerts-* 200 9ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1248\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":100,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 100ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1249\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":77,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 77ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1413\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":80,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 80ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":13,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"log\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"error\",\"opensearch\",\"data\"],\"pid\":460,\"message\":\"[version_conflict_engine_exception]: [search-telemetry:search-telemetry]: version conflict, required seqNo [9986], primary term [11]. current document has seqNo [9987] and primary term [11]\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1370\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":79,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 79ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":14,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/ui/favicons/favicon.ico\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"no-cors\",\"sec-fetch-dest\":\"image\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":7,\"contentLength\":9},\"message\":\"GET /ui/favicons/favicon.ico 200 7ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":15,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.995+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1567\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":123,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 123ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"281\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":72,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 72ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":17,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1307\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":117,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 117ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1249\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":94,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 94ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1308\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":83,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 83ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":18,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1429\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":80,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 80ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1308\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":139,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 139ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1626\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":74,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 74ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1472\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":77,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 77ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1312\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":91,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 91ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/internal/search/opensearch\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"1430\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"content-type\":\"application/json\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"osd-version\":\"1.2.0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"accept\":\"*/*\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":67,\"contentLength\":9},\"message\":\"POST /internal/search/opensearch 200 67ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:33 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:33Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"368\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":56,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 56ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:33","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:33 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:33Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"320\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":69,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 69ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:33","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:33 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:33Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"544\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":79,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 79ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:33","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:33 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:33Z\",\"tags\":[],\"pid\":460,\"method\":\"post\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/alerts\",\"method\":\"post\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"content-length\":\"378\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"id\":\"default\",\"pattern\":\"wazuh-alerts-*\",\"content-type\":\"application/json\",\"accept\":\"application/json, text/plain, */*\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"origin\":\"https://192.168.61.147\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":63,\"contentLength\":9},\"message\":\"POST /elastic/alerts 200 63ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:33","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":16,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"error\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[\"connection\",\"client\",\"error\"],\"pid\":460,\"level\":\"error\",\"error\":{\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\",\"name\":\"Error\",\"stack\":\"Error: 139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"},\"message\":\"139665293260672:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\\n\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:33.996+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315253.3219727","full_log":"Dec  6 08:27:32 wazuh-server opensearch-dashboards: {\"type\":\"response\",\"@timestamp\":\"2022-12-06T08:27:32Z\",\"tags\":[],\"pid\":460,\"method\":\"get\",\"statusCode\":200,\"req\":{\"url\":\"/elastic/samplealerts\",\"method\":\"get\",\"headers\":{\"host\":\"192.168.61.147\",\"connection\":\"keep-alive\",\"sec-ch-ua\":\"\\\"Not?A_Brand\\\";v=\\\"8\\\", \\\"Chromium\\\";v=\\\"108\\\", \\\"Google Chrome\\\";v=\\\"108\\\"\",\"accept\":\"application/json, text/plain, */*\",\"content-type\":\"application/json\",\"osd-xsrf\":\"kibana\",\"sec-ch-ua-mobile\":\"?0\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-mode\":\"cors\",\"sec-fetch-dest\":\"empty\",\"referer\":\"https://192.168.61.147/app/wazuh\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7\"},\"remoteAddress\":\"192.168.136.52\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"referer\":\"https://192.168.61.147/app/wazuh\"},\"res\":{\"statusCode\":200,\"responseTime\":5,\"contentLength\":9},\"message\":\"GET /elastic/samplealerts 200 5ms - 9.0B\"}","predecoder":{"program_name":"opensearch-dashboards","timestamp":"Dec  6 08:27:32","hostname":"wazuh-server"},"decoder":{},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:27:41.959+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315261.3219727","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:27:42.5553362Z\",\"eventRecordID\":\"10780\",\"processID\":\"1144\",\"threadID\":\"18928\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:27:42.5553362Z","eventRecordID":"10780","processID":"1144","threadID":"18928","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:41.991+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":55,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315261.3221614","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:41.9191566Z\",\"eventRecordID\":\"10311797\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tUSB\\\\VID_0781&PID_5591\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3\\r\\n\\r\\nNazwa urządzenia:\\tUSB Mass Storage Device\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{36fc9e60-c465-11cf-8056-444553540000}\\r\\n\\r\\nNazwa klasy:\\tUSB\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tUSB\\\\VID_0781&PID_5591&REV_0100\\r\\n\\t\\tUSB\\\\VID_0781&PID_5591\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUSB\\\\Class_08&SubClass_06&Prot_50\\r\\n\\t\\tUSB\\\\Class_08&SubClass_06\\r\\n\\t\\tUSB\\\\Class_08\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\tPort_#0002.Hub_#0004\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"USB\\\\\\\\VID_0781&amp;PID_5591\\\\\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3\",\"deviceDescription\":\"USB Mass Storage Device\",\"classId\":\"{36fc9e60-c465-11cf-8056-444553540000}\",\"className\":\"USB\",\"vendorIds\":\"    USB\\\\\\\\VID_0781&amp;PID_5591&amp;REV_0100    USB\\\\\\\\VID_0781&amp;PID_5591\",\"compatibleIds\":\"    USB\\\\\\\\Class_08&amp;SubClass_06&amp;Prot_50    USB\\\\\\\\Class_08&amp;SubClass_06    USB\\\\\\\\Class_08\",\"locationInformation\":\"    Port_#0002.Hub_#0004\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:41.9191566Z","eventRecordID":"10311797","processID":"4","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tUSB\\VID_0781&PID_5591\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3\r\n\r\nNazwa urządzenia:\tUSB Mass Storage Device\r\n\r\nIdentyfikator klasy:\t\t{36fc9e60-c465-11cf-8056-444553540000}\r\n\r\nNazwa klasy:\tUSB\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tUSB\\VID_0781&PID_5591&REV_0100\r\n\t\tUSB\\VID_0781&PID_5591\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUSB\\Class_08&SubClass_06&Prot_50\r\n\t\tUSB\\Class_08&SubClass_06\r\n\t\tUSB\\Class_08\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\tPort_#0002.Hub_#0004\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"USB\\\\VID_0781&amp;PID_5591\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3","deviceDescription":"USB Mass Storage Device","classId":"{36fc9e60-c465-11cf-8056-444553540000}","className":"USB","vendorIds":"    USB\\\\VID_0781&amp;PID_5591&amp;REV_0100    USB\\\\VID_0781&amp;PID_5591","compatibleIds":"    USB\\\\Class_08&amp;SubClass_06&amp;Prot_50    USB\\\\Class_08&amp;SubClass_06    USB\\\\Class_08","locationInformation":"    Port_#0002.Hub_#0004"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.024+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":56,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3225858","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:41.9372138Z\",\"eventRecordID\":\"10311798\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tUSBSTOR\\\\Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163\\r\\n\\r\\nNazwa urządzenia:\\t USB  SanDisk 3.2Gen1 USB Device\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e967-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDiskDrive\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tUSBSTOR\\\\Disk_USB_____SanDisk_3.2Gen11.00\\r\\n\\t\\tUSBSTOR\\\\Disk_USB_____SanDisk_3.2Gen1\\r\\n\\t\\tUSBSTOR\\\\Disk_USB____\\r\\n\\t\\tUSBSTOR\\\\_USB_____SanDisk_3.2Gen11\\r\\n\\t\\t_USB_____SanDisk_3.2Gen11\\r\\n\\t\\tUSBSTOR\\\\GenDisk\\r\\n\\t\\tGenDisk\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUSBSTOR\\\\Disk\\r\\n\\t\\tUSBSTOR\\\\RAW\\r\\n\\t\\tGenDisk\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"USBSTOR\\\\\\\\Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00\\\\\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163\",\"deviceDescription\":\" USB  SanDisk 3.2Gen1 USB Device\",\"classId\":\"{4d36e967-e325-11ce-bfc1-08002be10318}\",\"className\":\"DiskDrive\",\"vendorIds\":\"    USBSTOR\\\\\\\\Disk_USB_____SanDisk_3.2Gen11.00    USBSTOR\\\\\\\\Disk_USB_____SanDisk_3.2Gen1    USBSTOR\\\\\\\\Disk_USB____    USBSTOR\\\\\\\\_USB_____SanDisk_3.2Gen11    _USB_____SanDisk_3.2Gen11    USBSTOR\\\\\\\\GenDisk    GenDisk\",\"compatibleIds\":\"    USBSTOR\\\\\\\\Disk    USBSTOR\\\\\\\\RAW    GenDisk\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:41.9372138Z","eventRecordID":"10311798","processID":"4","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tUSBSTOR\\Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163\r\n\r\nNazwa urządzenia:\t USB  SanDisk 3.2Gen1 USB Device\r\n\r\nIdentyfikator klasy:\t\t{4d36e967-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDiskDrive\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tUSBSTOR\\Disk_USB_____SanDisk_3.2Gen11.00\r\n\t\tUSBSTOR\\Disk_USB_____SanDisk_3.2Gen1\r\n\t\tUSBSTOR\\Disk_USB____\r\n\t\tUSBSTOR\\_USB_____SanDisk_3.2Gen11\r\n\t\t_USB_____SanDisk_3.2Gen11\r\n\t\tUSBSTOR\\GenDisk\r\n\t\tGenDisk\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUSBSTOR\\Disk\r\n\t\tUSBSTOR\\RAW\r\n\t\tGenDisk\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"USBSTOR\\\\Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163","deviceDescription":" USB  SanDisk 3.2Gen1 USB Device","classId":"{4d36e967-e325-11ce-bfc1-08002be10318}","className":"DiskDrive","vendorIds":"    USBSTOR\\\\Disk_USB_____SanDisk_3.2Gen11.00    USBSTOR\\\\Disk_USB_____SanDisk_3.2Gen1    USBSTOR\\\\Disk_USB____    USBSTOR\\\\_USB_____SanDisk_3.2Gen11    _USB_____SanDisk_3.2Gen11    USBSTOR\\\\GenDisk    GenDisk","compatibleIds":"    USBSTOR\\\\Disk    USBSTOR\\\\RAW    GenDisk"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.035+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":326,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3230313","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:41.9383652Z\",\"eventRecordID\":\"10311799\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:41.9383652Z","eventRecordID":"10311799","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.073+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3230313","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:41.9383837Z\",\"eventRecordID\":\"10311800\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:41.9383837Z","eventRecordID":"10311800","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.085+0000","rule":{"level":5,"description":"Windows: Authorized PNP device connected.","id":"100002","firedtimes":1,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3238424","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:41.9444135Z\",\"eventRecordID\":\"10311801\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSTORAGE\\\\Volume\\\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\\r\\n\\r\\nNazwa urządzenia:\\tVolume\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{71a27cdd-812a-11d0-bec7-08002be2092f}\\r\\n\\r\\nNazwa klasy:\\tVolume\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tSTORAGE\\\\Volume\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"STORAGE\\\\\\\\Volume\\\\\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\",\"deviceDescription\":\"Volume\",\"classId\":\"{71a27cdd-812a-11d0-bec7-08002be2092f}\",\"className\":\"Volume\",\"vendorIds\":\"    STORAGE\\\\\\\\Volume\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:41.9444135Z","eventRecordID":"10311801","processID":"4","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSTORAGE\\Volume\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\r\n\r\nNazwa urządzenia:\tVolume\r\n\r\nIdentyfikator klasy:\t\t{71a27cdd-812a-11d0-bec7-08002be2092f}\r\n\r\nNazwa klasy:\tVolume\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tSTORAGE\\Volume\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"STORAGE\\\\Volume\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}","deviceDescription":"Volume","classId":"{71a27cdd-812a-11d0-bec7-08002be2092f}","className":"Volume","vendorIds":"    STORAGE\\\\Volume"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.126+0000","rule":{"level":5,"description":"Windows: Authorized PNP device connected.","id":"100002","firedtimes":2,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.2956730Z\",\"eventRecordID\":\"10311802\",\"processID\":\"4\",\"threadID\":\"12392\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\WPDBUSENUM\\\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\\r\\n\\r\\nNazwa urządzenia:\\tD:\\\\\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{eec5ad98-8080-425f-922a-dabf3de3f69a}\\r\\n\\r\\nNazwa klasy:\\tWPD\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\twpdbusenum\\\\fs\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\WPDBUSENUM\\\\\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\",\"deviceDescription\":\"D:\\\\\\\\\",\"classId\":\"{eec5ad98-8080-425f-922a-dabf3de3f69a}\",\"className\":\"WPD\",\"compatibleIds\":\"    wpdbusenum\\\\\\\\fs    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.2956730Z","eventRecordID":"10311802","processID":"4","threadID":"12392","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\WPDBUSENUM\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\r\n\r\nNazwa urządzenia:\tD:\\\r\n\r\nIdentyfikator klasy:\t\t{eec5ad98-8080-425f-922a-dabf3de3f69a}\r\n\r\nNazwa klasy:\tWPD\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\twpdbusenum\\fs\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\WPDBUSENUM\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}","deviceDescription":"D:\\\\","classId":"{eec5ad98-8080-425f-922a-dabf3de3f69a}","className":"WPD","compatibleIds":"    wpdbusenum\\\\fs    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.130+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.3495223Z\",\"eventRecordID\":\"10311803\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.3495223Z","eventRecordID":"10311803","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.130+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.3496061Z\",\"eventRecordID\":\"10311804\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.3496061Z","eventRecordID":"10311804","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.164+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.3500151Z\",\"eventRecordID\":\"10311805\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.3500151Z","eventRecordID":"10311805","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.174+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.8847706Z\",\"eventRecordID\":\"10311807\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.8847706Z","eventRecordID":"10311807","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.174+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.8781440Z\",\"eventRecordID\":\"10311806\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.8781440Z","eventRecordID":"10311806","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.182+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.8884583Z\",\"eventRecordID\":\"10311808\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.8884583Z","eventRecordID":"10311808","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:42.244+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315262.3241944","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:42.8886275Z\",\"eventRecordID\":\"10311809\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:42.8886275Z","eventRecordID":"10311809","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.697+0000","rule":{"level":3,"description":"Service startup type was changed","id":"61104","info":"This does not appear to be logged on Windows 2000","firedtimes":9,"mail":false,"groups":["windows","windows_system","policy_changed"],"pci_dss":["10.6"],"gdpr":["IV_35.7.d"],"hipaa":["164.312.b"],"nist_800_53":["AU.6"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3245518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Service Control Manager\",\"providerGuid\":\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\",\"eventSourceName\":\"Service Control Manager\",\"eventID\":\"7040\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:27:47.3142682Z\",\"eventRecordID\":\"10781\",\"processID\":\"1012\",\"threadID\":\"17208\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\\\"\"},\"eventdata\":{\"param1\":\"Usługa inteligentnego transferu w tle\",\"param2\":\"uruchamianie na żądanie\",\"param3\":\"autostart\",\"param4\":\"BITS\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Service Control Manager","providerGuid":"{555908d1-a6d7-4695-8e1e-26931d2012f4}","eventSourceName":"Service Control Manager","eventID":"7040","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:27:47.3142682Z","eventRecordID":"10781","processID":"1012","threadID":"17208","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Typ uruchamiania usługi Usługa inteligentnego transferu w tle został zmieniony z uruchamianie na żądanie na autostart.\""},"eventdata":{"param1":"Usługa inteligentnego transferu w tle","param2":"uruchamianie na żądanie","param3":"autostart","param4":"BITS"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.716+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3245518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:46.6451752Z\",\"eventRecordID\":\"10311810\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:46.6451752Z","eventRecordID":"10311810","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.720+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3245518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:46.6452551Z\",\"eventRecordID\":\"10311811\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:46.6452551Z","eventRecordID":"10311811","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.732+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3245518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:46.6457239Z\",\"eventRecordID\":\"10311812\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:46.6457239Z","eventRecordID":"10311812","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.751+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":327,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3247407","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:46.9720234Z\",\"eventRecordID\":\"10311813\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:46.9720234Z","eventRecordID":"10311813","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.767+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3247407","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:46.9720482Z\",\"eventRecordID\":\"10311814\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:46.9720482Z","eventRecordID":"10311814","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.778+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3247407","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.0604841Z\",\"eventRecordID\":\"10311815\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.0604841Z","eventRecordID":"10311815","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.799+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3247407","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.0615000Z\",\"eventRecordID\":\"10311816\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.0615000Z","eventRecordID":"10311816","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.866+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3247407","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.0652024Z\",\"eventRecordID\":\"10311817\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.0652024Z","eventRecordID":"10311817","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.873+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3247407","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.0653026Z\",\"eventRecordID\":\"10311818\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.0653026Z","eventRecordID":"10311818","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.892+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":328,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.2053289Z\",\"eventRecordID\":\"10311819\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.2053289Z","eventRecordID":"10311819","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.914+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.2053562Z\",\"eventRecordID\":\"10311820\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.2053562Z","eventRecordID":"10311820","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.925+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.3889432Z\",\"eventRecordID\":\"10311821\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.3889432Z","eventRecordID":"10311821","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.936+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.3895021Z\",\"eventRecordID\":\"10311823\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.3895021Z","eventRecordID":"10311823","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.936+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.3890215Z\",\"eventRecordID\":\"10311822\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.3890215Z","eventRecordID":"10311822","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.949+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.5738956Z\",\"eventRecordID\":\"10311824\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-544\\r\\n\\tNazwa grupy:\\t\\tAdministratorzy\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4898\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administratorzy\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-544\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4898\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.5738956Z","eventRecordID":"10311824","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-544\r\n\tNazwa grupy:\t\tAdministratorzy\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4898\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Administratorzy","targetDomainName":"Builtin","targetSid":"S-1-5-32-544","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4898","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.952+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.5750422Z\",\"eventRecordID\":\"10311825\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-551\\r\\n\\tNazwa grupy:\\t\\tOperatorzy kopii zapasowych\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x4898\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Operatorzy kopii zapasowych\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-551\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x4898\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.5750422Z","eventRecordID":"10311825","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-551\r\n\tNazwa grupy:\t\tOperatorzy kopii zapasowych\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x4898\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\svchost.exe\""},"eventdata":{"targetUserName":"Operatorzy kopii zapasowych","targetDomainName":"Builtin","targetSid":"S-1-5-32-551","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x4898","callerProcessName":"C:\\\\Windows\\\\System32\\\\svchost.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:46.957+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315266.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16394\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:27:47.8054722Z\",\"eventRecordID\":\"7359\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\\\"\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16394","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:27:47.8054722Z","eventRecordID":"7359","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Migracja na niższym poziomie w trybie offline zakończyła się pomyślnie.\""}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:47.867+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315267.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.8024667Z\",\"eventRecordID\":\"10311826\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.8024667Z","eventRecordID":"10311826","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:47.879+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315267.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.8032782Z\",\"eventRecordID\":\"10311827\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.8032782Z","eventRecordID":"10311827","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:47.887+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315267.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.8061519Z\",\"eventRecordID\":\"10311828\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.8061519Z","eventRecordID":"10311828","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:48.008+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315268.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:47.8062633Z\",\"eventRecordID\":\"10311829\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:47.8062633Z","eventRecordID":"10311829","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:48.915+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315268.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:27:49.7438188Z\",\"eventRecordID\":\"10782\",\"processID\":\"1144\",\"threadID\":\"15044\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:27:49.7438188Z","eventRecordID":"10782","processID":"1144","threadID":"15044","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.139+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.0650821Z\",\"eventRecordID\":\"10311830\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.0650821Z","eventRecordID":"10311830","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.144+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.0651638Z\",\"eventRecordID\":\"10311831\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.0651638Z","eventRecordID":"10311831","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.156+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.0656084Z\",\"eventRecordID\":\"10311832\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.0656084Z","eventRecordID":"10311832","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.161+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.1629006Z\",\"eventRecordID\":\"10311833\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.1629006Z","eventRecordID":"10311833","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.175+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.1629829Z\",\"eventRecordID\":\"10311834\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.1629829Z","eventRecordID":"10311834","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(token):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.180+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.1633978Z\",\"eventRecordID\":\"10311835\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.1633978Z","eventRecordID":"10311835","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"WindowsLive:(cert):name=02xpgixrqyleunkh;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.196+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.6096918Z\",\"eventRecordID\":\"10311836\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.6096918Z","eventRecordID":"10311836","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.200+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.6104090Z\",\"eventRecordID\":\"10311837\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.6104090Z","eventRecordID":"10311837","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.215+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.6131507Z\",\"eventRecordID\":\"10311838\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.6131507Z","eventRecordID":"10311838","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.259+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.6132206Z\",\"eventRecordID\":\"10311839\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.6132206Z","eventRecordID":"10311839","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.271+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.8632189Z\",\"eventRecordID\":\"10311840\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.8632189Z","eventRecordID":"10311840","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.287+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.8672565Z\",\"eventRecordID\":\"10311841\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.8672565Z","eventRecordID":"10311841","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.302+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.8700553Z\",\"eventRecordID\":\"10311842\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.8700553Z","eventRecordID":"10311842","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:49.309+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315269.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:49.8701292Z\",\"eventRecordID\":\"10311843\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftAccount:user=02xpgixrqyleunkh\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:49.8701292Z","eventRecordID":"10311843","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftAccount:user=02xpgixrqyleunkh","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.288+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.2228785Z\",\"eventRecordID\":\"10311844\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.2228785Z","eventRecordID":"10311844","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.307+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.2229561Z\",\"eventRecordID\":\"10311845\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.2229561Z","eventRecordID":"10311845","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.318+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.2234401Z\",\"eventRecordID\":\"10311846\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.2234401Z","eventRecordID":"10311846","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.331+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.2283129Z\",\"eventRecordID\":\"10311847\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.2283129Z","eventRecordID":"10311847","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.335+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.2283830Z\",\"eventRecordID\":\"10311848\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.2283830Z","eventRecordID":"10311848","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.351+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.2287475Z\",\"eventRecordID\":\"10311849\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.2287475Z","eventRecordID":"10311849","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.361+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.9517341Z\",\"eventRecordID\":\"10311850\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.9517341Z","eventRecordID":"10311850","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.382+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.9530809Z\",\"eventRecordID\":\"10311851\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.9530809Z","eventRecordID":"10311851","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.391+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.9587951Z\",\"eventRecordID\":\"10311852\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.9587951Z","eventRecordID":"10311852","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.443+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:50.9589533Z\",\"eventRecordID\":\"10311853\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:50.9589533Z","eventRecordID":"10311853","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.452+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:51.0396873Z\",\"eventRecordID\":\"10311854\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:51.0396873Z","eventRecordID":"10311854","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.474+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:51.0404445Z\",\"eventRecordID\":\"10311855\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:51.0404445Z","eventRecordID":"10311855","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.487+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:51.0441047Z\",\"eventRecordID\":\"10311856\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:51.0441047Z","eventRecordID":"10311856","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:50.609+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315270.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:51.0441982Z\",\"eventRecordID\":\"10311857\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:51.0441982Z","eventRecordID":"10311857","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:53.531+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315273.3255518","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-DistributedCOM\",\"providerGuid\":\"{1B562E86-B7AA-4131-BADC-B6F3A001407E}\",\"eventSourceName\":\"DCOM\",\"eventID\":\"10016\",\"version\":\"0\",\"level\":\"3\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x8080000000000000\",\"systemTime\":\"2022-12-06T08:27:53.8824543Z\",\"eventRecordID\":\"10783\",\"processID\":\"1144\",\"threadID\":\"18928\",\"channel\":\"System\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"WARNING\",\"message\":\"\\\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \\r\\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\\r\\n i identyfikatorem aplikacji APPID \\r\\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\\r\\n użytkownikowi DOMAIN\\\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\\\"\"},\"eventdata\":{\"param1\":\"domyślne ustawienia komputera\",\"param2\":\"Lokalny\",\"param3\":\"Aktywacja\",\"param4\":\"{C2F03A33-21F5-47FA-B4BB-156362A2F239}\",\"param5\":\"{316CDED5-E4AE-4B15-9113-7055D84DCC97}\",\"param6\":\"DOMAIN\",\"param7\":\"user1\",\"param8\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"param9\":\"LocalHost (użycie LRPC)\",\"param10\":\"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy\",\"param11\":\"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-DistributedCOM","providerGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","eventSourceName":"DCOM","eventID":"10016","version":"0","level":"3","task":"0","opcode":"0","keywords":"0x8080000000000000","systemTime":"2022-12-06T08:27:53.8824543Z","eventRecordID":"10783","processID":"1144","threadID":"18928","channel":"System","computer":"PC15.DOMAIN.pl","severityValue":"WARNING","message":"\"Zgodnie z ustawieniami uprawnienia domyślne ustawienia komputera nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID \r\n{C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n i identyfikatorem aplikacji APPID \r\n{316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n użytkownikowi DOMAIN\\user1 o identyfikatorze zabezpieczeń SID (S-1-5-21-507921405-362288127-725345543-23289) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.\""},"eventdata":{"param1":"domyślne ustawienia komputera","param2":"Lokalny","param3":"Aktywacja","param4":"{C2F03A33-21F5-47FA-B4BB-156362A2F239}","param5":"{316CDED5-E4AE-4B15-9113-7055D84DCC97}","param6":"DOMAIN","param7":"user1","param8":"S-1-5-21-507921405-362288127-725345543-23289","param9":"LocalHost (użycie LRPC)","param10":"Microsoft.Windows.ShellExperienceHost_10.0.19041.1949_neutral_neutral_cw5n1h2txyewy","param11":"S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:53.549+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":57,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315273.3263629","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:53.4789624Z\",\"eventRecordID\":\"10311858\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tUSB\\\\VID_0781&PID_5591\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3\\r\\n\\r\\nNazwa urządzenia:\\tUSB Mass Storage Device\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{36fc9e60-c465-11cf-8056-444553540000}\\r\\n\\r\\nNazwa klasy:\\tUSB\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tUSB\\\\VID_0781&PID_5591&REV_0100\\r\\n\\t\\tUSB\\\\VID_0781&PID_5591\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUSB\\\\Class_08&SubClass_06&Prot_50\\r\\n\\t\\tUSB\\\\Class_08&SubClass_06\\r\\n\\t\\tUSB\\\\Class_08\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t\\r\\n\\t\\tPort_#0002.Hub_#0004\\r\\n\\t\\t\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"USB\\\\\\\\VID_0781&amp;PID_5591\\\\\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3\",\"deviceDescription\":\"USB Mass Storage Device\",\"classId\":\"{36fc9e60-c465-11cf-8056-444553540000}\",\"className\":\"USB\",\"vendorIds\":\"    USB\\\\\\\\VID_0781&amp;PID_5591&amp;REV_0100    USB\\\\\\\\VID_0781&amp;PID_5591\",\"compatibleIds\":\"    USB\\\\\\\\Class_08&amp;SubClass_06&amp;Prot_50    USB\\\\\\\\Class_08&amp;SubClass_06    USB\\\\\\\\Class_08\",\"locationInformation\":\"    Port_#0002.Hub_#0004\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:53.4789624Z","eventRecordID":"10311858","processID":"4","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tUSB\\VID_0781&PID_5591\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3\r\n\r\nNazwa urządzenia:\tUSB Mass Storage Device\r\n\r\nIdentyfikator klasy:\t\t{36fc9e60-c465-11cf-8056-444553540000}\r\n\r\nNazwa klasy:\tUSB\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tUSB\\VID_0781&PID_5591&REV_0100\r\n\t\tUSB\\VID_0781&PID_5591\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUSB\\Class_08&SubClass_06&Prot_50\r\n\t\tUSB\\Class_08&SubClass_06\r\n\t\tUSB\\Class_08\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t\r\n\t\tPort_#0002.Hub_#0004\r\n\t\t\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"USB\\\\VID_0781&amp;PID_5591\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc16301bc6000000000000000000005a25504b00147c1891558107472cc6f3","deviceDescription":"USB Mass Storage Device","classId":"{36fc9e60-c465-11cf-8056-444553540000}","className":"USB","vendorIds":"    USB\\\\VID_0781&amp;PID_5591&amp;REV_0100    USB\\\\VID_0781&amp;PID_5591","compatibleIds":"    USB\\\\Class_08&amp;SubClass_06&amp;Prot_50    USB\\\\Class_08&amp;SubClass_06    USB\\\\Class_08","locationInformation":"    Port_#0002.Hub_#0004"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:53.554+0000","rule":{"level":7,"description":"Windows: Unauthorized PNP device connected.","id":"100003","firedtimes":58,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315273.3267873","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:53.4980349Z\",\"eventRecordID\":\"10311859\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tUSBSTOR\\\\Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163\\r\\n\\r\\nNazwa urządzenia:\\t USB  SanDisk 3.2Gen1 USB Device\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{4d36e967-e325-11ce-bfc1-08002be10318}\\r\\n\\r\\nNazwa klasy:\\tDiskDrive\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tUSBSTOR\\\\Disk_USB_____SanDisk_3.2Gen11.00\\r\\n\\t\\tUSBSTOR\\\\Disk_USB_____SanDisk_3.2Gen1\\r\\n\\t\\tUSBSTOR\\\\Disk_USB____\\r\\n\\t\\tUSBSTOR\\\\_USB_____SanDisk_3.2Gen11\\r\\n\\t\\t_USB_____SanDisk_3.2Gen11\\r\\n\\t\\tUSBSTOR\\\\GenDisk\\r\\n\\t\\tGenDisk\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\tUSBSTOR\\\\Disk\\r\\n\\t\\tUSBSTOR\\\\RAW\\r\\n\\t\\tGenDisk\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"USBSTOR\\\\\\\\Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00\\\\\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163\",\"deviceDescription\":\" USB  SanDisk 3.2Gen1 USB Device\",\"classId\":\"{4d36e967-e325-11ce-bfc1-08002be10318}\",\"className\":\"DiskDrive\",\"vendorIds\":\"    USBSTOR\\\\\\\\Disk_USB_____SanDisk_3.2Gen11.00    USBSTOR\\\\\\\\Disk_USB_____SanDisk_3.2Gen1    USBSTOR\\\\\\\\Disk_USB____    USBSTOR\\\\\\\\_USB_____SanDisk_3.2Gen11    _USB_____SanDisk_3.2Gen11    USBSTOR\\\\\\\\GenDisk    GenDisk\",\"compatibleIds\":\"    USBSTOR\\\\\\\\Disk    USBSTOR\\\\\\\\RAW    GenDisk\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:53.4980349Z","eventRecordID":"10311859","processID":"4","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tUSBSTOR\\Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163\r\n\r\nNazwa urządzenia:\t USB  SanDisk 3.2Gen1 USB Device\r\n\r\nIdentyfikator klasy:\t\t{4d36e967-e325-11ce-bfc1-08002be10318}\r\n\r\nNazwa klasy:\tDiskDrive\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tUSBSTOR\\Disk_USB_____SanDisk_3.2Gen11.00\r\n\t\tUSBSTOR\\Disk_USB_____SanDisk_3.2Gen1\r\n\t\tUSBSTOR\\Disk_USB____\r\n\t\tUSBSTOR\\_USB_____SanDisk_3.2Gen11\r\n\t\t_USB_____SanDisk_3.2Gen11\r\n\t\tUSBSTOR\\GenDisk\r\n\t\tGenDisk\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t\r\n\t\tUSBSTOR\\Disk\r\n\t\tUSBSTOR\\RAW\r\n\t\tGenDisk\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"USBSTOR\\\\Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00\\\\04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163","deviceDescription":" USB  SanDisk 3.2Gen1 USB Device","classId":"{4d36e967-e325-11ce-bfc1-08002be10318}","className":"DiskDrive","vendorIds":"    USBSTOR\\\\Disk_USB_____SanDisk_3.2Gen11.00    USBSTOR\\\\Disk_USB_____SanDisk_3.2Gen1    USBSTOR\\\\Disk_USB____    USBSTOR\\\\_USB_____SanDisk_3.2Gen11    _USB_____SanDisk_3.2Gen11    USBSTOR\\\\GenDisk    GenDisk","compatibleIds":"    USBSTOR\\\\Disk    USBSTOR\\\\RAW    GenDisk"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:53.575+0000","rule":{"level":5,"description":"Windows: Authorized PNP device connected.","id":"100002","firedtimes":3,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315273.3275848","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:53.5055579Z\",\"eventRecordID\":\"10311860\",\"processID\":\"4\",\"threadID\":\"12512\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSTORAGE\\\\Volume\\\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\\r\\n\\r\\nNazwa urządzenia:\\tVolume\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{71a27cdd-812a-11d0-bec7-08002be2092f}\\r\\n\\r\\nNazwa klasy:\\tVolume\\r\\n\\r\\nIdentyfikatory sprzętu:\\t\\r\\n\\t\\tSTORAGE\\\\Volume\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nZgodne identyfikatory:\\t-\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"STORAGE\\\\\\\\Volume\\\\\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\",\"deviceDescription\":\"Volume\",\"classId\":\"{71a27cdd-812a-11d0-bec7-08002be2092f}\",\"className\":\"Volume\",\"vendorIds\":\"    STORAGE\\\\\\\\Volume\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:53.5055579Z","eventRecordID":"10311860","processID":"4","threadID":"12512","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSTORAGE\\Volume\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\r\n\r\nNazwa urządzenia:\tVolume\r\n\r\nIdentyfikator klasy:\t\t{71a27cdd-812a-11d0-bec7-08002be2092f}\r\n\r\nNazwa klasy:\tVolume\r\n\r\nIdentyfikatory sprzętu:\t\r\n\t\tSTORAGE\\Volume\r\n\t\t\r\n\t\t\r\n\r\nZgodne identyfikatory:\t-\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"STORAGE\\\\Volume\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}","deviceDescription":"Volume","classId":"{71a27cdd-812a-11d0-bec7-08002be2092f}","className":"Volume","vendorIds":"    STORAGE\\\\Volume"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:53.575+0000","rule":{"level":5,"description":"Windows: Authorized PNP device connected.","id":"100002","firedtimes":4,"mail":false,"groups":["local","syslog","sshd"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315273.3275848","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"6416\",\"version\":\"1\",\"level\":\"0\",\"task\":\"13316\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:53.6885155Z\",\"eventRecordID\":\"10311861\",\"processID\":\"4\",\"threadID\":\"14612\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"System rozpoznał nowe urządzenie zewnętrzne.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nIdentyfikator urządzenia:\\tSWD\\\\WPDBUSENUM\\\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\\r\\n\\r\\nNazwa urządzenia:\\tD:\\\\\\r\\n\\r\\nIdentyfikator klasy:\\t\\t{eec5ad98-8080-425f-922a-dabf3de3f69a}\\r\\n\\r\\nNazwa klasy:\\tWPD\\r\\n\\r\\nIdentyfikatory sprzętu:\\t-\\r\\n\\r\\nZgodne identyfikatory:\\t\\r\\n\\t\\twpdbusenum\\\\fs\\r\\n\\t\\tSWD\\\\Generic\\r\\n\\t\\t\\r\\n\\t\\t\\r\\n\\r\\nInformacje o lokalizacji:\\t-\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"deviceId\":\"SWD\\\\\\\\WPDBUSENUM\\\\\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\",\"deviceDescription\":\"D:\\\\\\\\\",\"classId\":\"{eec5ad98-8080-425f-922a-dabf3de3f69a}\",\"className\":\"WPD\",\"compatibleIds\":\"    wpdbusenum\\\\\\\\fs    SWD\\\\\\\\Generic\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:53.6885155Z","eventRecordID":"10311861","processID":"4","threadID":"14612","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"System rozpoznał nowe urządzenie zewnętrzne.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nIdentyfikator urządzenia:\tSWD\\WPDBUSENUM\\_??_USBSTOR#Disk&Ven__USB&Prod__SanDisk_3.2Gen1&Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\r\n\r\nNazwa urządzenia:\tD:\\\r\n\r\nIdentyfikator klasy:\t\t{eec5ad98-8080-425f-922a-dabf3de3f69a}\r\n\r\nNazwa klasy:\tWPD\r\n\r\nIdentyfikatory sprzętu:\t-\r\n\r\nZgodne identyfikatory:\t\r\n\t\twpdbusenum\\fs\r\n\t\tSWD\\Generic\r\n\t\t\r\n\t\t\r\n\r\nInformacje o lokalizacji:\t-\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","deviceId":"SWD\\\\WPDBUSENUM\\\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}","deviceDescription":"D:\\\\","classId":"{eec5ad98-8080-425f-922a-dabf3de3f69a}","className":"WPD","compatibleIds":"    wpdbusenum\\\\fs    SWD\\\\Generic"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:27:53.590+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315273.3275848","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:27:53.9630663Z\",\"eventRecordID\":\"10311862\",\"processID\":\"416\",\"threadID\":\"8908\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-21-507921405-362288127-725345543-23289\\r\\n\\tNazwa konta:\\t\\tajupa\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x16B11C\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-21-507921405-362288127-725345543-23289\",\"subjectUserName\":\"user1\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x16b11c\",\"targetName\":\"MicrosoftOffice16_Data:live:cid=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:27:52.5208796Z\",\"clientProcessId\":\"14172\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:27:53.9630663Z","eventRecordID":"10311862","processID":"416","threadID":"8908","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-21-507921405-362288127-725345543-23289\r\n\tNazwa konta:\t\tajupa\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x16B11C\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-21-507921405-362288127-725345543-23289","subjectUserName":"user1","subjectDomainName":"DOMAIN","subjectLogonId":"0x16b11c","targetName":"MicrosoftOffice16_Data:live:cid=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:27:52.5208796Z","clientProcessId":"14172"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:00.227+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315280.3275848","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4799\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13826\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:00.1604923Z\",\"eventRecordID\":\"10311863\",\"processID\":\"416\",\"threadID\":\"19696\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nGrupa:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-32-544\\r\\n\\tNazwa grupy:\\t\\tAdministratorzy\\r\\n\\tDomena grupy:\\t\\tBuiltin\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x23c4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\SysWOW64\\\\net1.exe\\\"\"},\"eventdata\":{\"targetUserName\":\"Administratorzy\",\"targetDomainName\":\"Builtin\",\"targetSid\":\"S-1-5-32-544\",\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"callerProcessId\":\"0x23c4\",\"callerProcessName\":\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\net1.exe\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4799","version":"0","level":"0","task":"13826","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:00.1604923Z","eventRecordID":"10311863","processID":"416","threadID":"19696","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Członkostwo grupy lokalnej z włączonymi zabezpieczeniami zostało wyliczone.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nGrupa:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-32-544\r\n\tNazwa grupy:\t\tAdministratorzy\r\n\tDomena grupy:\t\tBuiltin\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x23c4\r\n\tNazwa procesu:\t\tC:\\Windows\\SysWOW64\\net1.exe\""},"eventdata":{"targetUserName":"Administratorzy","targetDomainName":"Builtin","targetSid":"S-1-5-32-544","subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","callerProcessId":"0x23c4","callerProcessName":"C:\\\\Windows\\\\SysWOW64\\\\net1.exe"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:05.687+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":329,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315285.3275848","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:05.6094766Z\",\"eventRecordID\":\"10311864\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:05.6094766Z","eventRecordID":"10311864","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:05.719+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315285.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:05.6094942Z\",\"eventRecordID\":\"10311865\",\"processID\":\"416\",\"threadID\":\"12516\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:05.6094942Z","eventRecordID":"10311865","processID":"416","threadID":"12516","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.179+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.1168682Z\",\"eventRecordID\":\"10311866\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.1168682Z","eventRecordID":"10311866","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.190+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.1169530Z\",\"eventRecordID\":\"10311867\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.1169530Z","eventRecordID":"10311867","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(token):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.194+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.1173943Z\",\"eventRecordID\":\"10311868\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.1173943Z","eventRecordID":"10311868","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"WindowsLive:(cert):name=02qizlnvqmzkhlyc;serviceuri=*","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.205+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.5269373Z\",\"eventRecordID\":\"10311869\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.5269373Z","eventRecordID":"10311869","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.208+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.5275972Z\",\"eventRecordID\":\"10311870\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.5275972Z","eventRecordID":"10311870","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.219+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.5302804Z\",\"eventRecordID\":\"10311871\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.5302804Z","eventRecordID":"10311871","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.223+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3279422","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"5379\",\"version\":\"0\",\"level\":\"0\",\"task\":\"13824\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.5303620Z\",\"eventRecordID\":\"10311872\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Odczytano poświadczenia Menedżera poświadczeń.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\ntOperacja odczytu:\\t\\tWyliczenie poświadczeń\\r\\n\\r\\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetName\":\"MicrosoftAccount:user=02qizlnvqmzkhlyc\",\"type\":\"0\",\"countOfCredentialsReturned\":\"0\",\"readOperation\":\"%%8100\",\"returnCode\":\"3221226021\",\"processCreationTime\":\"2022-12-06T08:24:49.7583651Z\",\"clientProcessId\":\"12508\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"5379","version":"0","level":"0","task":"13824","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.5303620Z","eventRecordID":"10311872","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Odczytano poświadczenia Menedżera poświadczeń.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\ntOperacja odczytu:\t\tWyliczenie poświadczeń\r\n\r\nTo zdarzenie występuje, gdy użytkownik wykonuje operację odczytu poświadczeń przechowywanych w Menedżerze poświadczeń.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetName":"MicrosoftAccount:user=02qizlnvqmzkhlyc","type":"0","countOfCredentialsReturned":"0","readOperation":"%%8100","returnCode":"3221226021","processCreationTime":"2022-12-06T08:24:49.7583651Z","clientProcessId":"12508"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.239+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":330,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3287533","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.5338453Z\",\"eventRecordID\":\"10311873\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.5338453Z","eventRecordID":"10311873","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:15.248+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315295.3287533","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:15.5338679Z\",\"eventRecordID\":\"10311874\",\"processID\":\"416\",\"threadID\":\"14984\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:15.5338679Z","eventRecordID":"10311874","processID":"416","threadID":"14984","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:20.239+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315300.3287533","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"1003\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:28:21.1870127Z\",\"eventRecordID\":\"7360\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Usługa ochrony oprogramowania ukończyła sprawdzanie stanu licencjonowania.\\r\\nIdentyfikator aplikacji=55c92734-d682-4d71-983e-d6ec3f16059f\\r\\nStan licencji=\\n1: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\\n\\n\\\"\"},\"eventdata\":{\"data\":\"55c92734-d682-4d71-983e-d6ec3f16059f,  1: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"1003","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:28:21.1870127Z","eventRecordID":"7360","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Usługa ochrony oprogramowania ukończyła sprawdzanie stanu licencjonowania.\r\nIdentyfikator aplikacji=55c92734-d682-4d71-983e-d6ec3f16059f\r\nStan licencji=\n1: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n\n\""},"eventdata":{"data":"55c92734-d682-4d71-983e-d6ec3f16059f,  1: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:21.533+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315301.3287533","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-BitLocker-API\",\"providerGuid\":\"{5d674230-ca9f-11da-a94d-0800200c9a66}\",\"eventID\":\"782\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x4000000000000000\",\"systemTime\":\"2022-12-06T08:28:21.7772895Z\",\"eventRecordID\":\"45\",\"processID\":\"8996\",\"threadID\":\"14356\",\"channel\":\"Microsoft-Windows-BitLocker/BitLocker Management\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"The BitLocker protected volume D: was unlocked.\\r\\nProtector GUID: {d327c993-646d-4a0b-ab8c-52a0d1af9207}\\r\\nIdentification GUID: {7c406899-b032-40cf-b081-5e8bb16e302d}\\\"\"},\"eventdata\":{\"identificationGUID\":\"{7c406899-b032-40cf-b081-5e8bb16e302d}\",\"volumeName\":\"\\\\\\\\\\\\\\\\?\\\\\\\\Volume{75340d6c-4ba0-11ed-845f-e03f49a38646}\",\"volumeMountPoint\":\"D:\",\"protectorGUID\":\"{d327c993-646d-4a0b-ab8c-52a0d1af9207}\",\"protectorType\":\"0x8\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-BitLocker-API","providerGuid":"{5d674230-ca9f-11da-a94d-0800200c9a66}","eventID":"782","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x4000000000000000","systemTime":"2022-12-06T08:28:21.7772895Z","eventRecordID":"45","processID":"8996","threadID":"14356","channel":"Microsoft-Windows-BitLocker/BitLocker Management","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"The BitLocker protected volume D: was unlocked.\r\nProtector GUID: {d327c993-646d-4a0b-ab8c-52a0d1af9207}\r\nIdentification GUID: {7c406899-b032-40cf-b081-5e8bb16e302d}\""},"eventdata":{"identificationGUID":"{7c406899-b032-40cf-b081-5e8bb16e302d}","volumeName":"\\\\\\\\?\\\\Volume{75340d6c-4ba0-11ed-845f-e03f49a38646}","volumeMountPoint":"D:","protectorGUID":"{d327c993-646d-4a0b-ab8c-52a0d1af9207}","protectorType":"0x8"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:28.159+0000","rule":{"level":3,"description":"Windows logon success.","id":"60106","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":331,"mail":false,"groups":["windows","windows_security","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315308.3295644","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4624\",\"version\":\"2\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:28.0890604Z\",\"eventRecordID\":\"10311875\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Logowanie do konta zakończyło się pomyślnie.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nInformacje o logowaniu:\\r\\n\\tTyp logowania:\\t\\t5\\r\\n\\tOgraniczony tryb administratora:\\t-\\r\\n\\tKonto wirtualne:\\t\\tNie\\r\\n\\tToken z podniesionymi uprawnieniami:\\t\\tTak\\r\\n\\r\\nPoziom personifikacji:\\t\\tPersonifikacja\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\tPołączony identyfikator logowania:\\t\\t0x0\\r\\n\\tNazwa konta sieciowego:\\t-\\r\\n\\tDomena konta sieciowego:\\t-\\r\\n\\tIdentyfikator GUID logowania:\\t\\t{00000000-0000-0000-0000-000000000000}\\r\\n\\r\\nInformacje o procesie:\\r\\n\\tIdentyfikator procesu:\\t\\t0x3f4\\r\\n\\tNazwa procesu:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\r\\n\\r\\nInformacje o sieci:\\r\\n\\tNazwa stacji roboczej:\\t-\\r\\n\\tŹródłowy adres sieciowy:\\t-\\r\\n\\tPort źródłowy:\\t\\t-\\r\\n\\r\\nSzczegółowe informacje o logowaniu:\\r\\n\\tProces logowania:\\t\\tAdvapi  \\r\\n\\tPakiet uwierzytelniania:\\tNegotiate\\r\\n\\tUsługi przejściowe:\\t-\\r\\n\\tNazwa pakietu (tylko protokół NTLM):\\t-\\r\\n\\tDługość klucza:\\t\\t0\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\\r\\n\\r\\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\\r\\n\\r\\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\\r\\n\\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\\r\\n\\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\\r\\n\\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\\r\\n\\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"logonProcessName\":\"Advapi\",\"authenticationPackageName\":\"Negotiate\",\"logonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"keyLength\":\"0\",\"processId\":\"0x3f4\",\"processName\":\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe\",\"impersonationLevel\":\"%%1833\",\"virtualAccount\":\"%%1843\",\"targetLinkedLogonId\":\"0x0\",\"elevatedToken\":\"%%1842\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4624","version":"2","level":"0","task":"12544","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:28.0890604Z","eventRecordID":"10311875","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Logowanie do konta zakończyło się pomyślnie.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nInformacje o logowaniu:\r\n\tTyp logowania:\t\t5\r\n\tOgraniczony tryb administratora:\t-\r\n\tKonto wirtualne:\t\tNie\r\n\tToken z podniesionymi uprawnieniami:\t\tTak\r\n\r\nPoziom personifikacji:\t\tPersonifikacja\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\tPołączony identyfikator logowania:\t\t0x0\r\n\tNazwa konta sieciowego:\t-\r\n\tDomena konta sieciowego:\t-\r\n\tIdentyfikator GUID logowania:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nInformacje o procesie:\r\n\tIdentyfikator procesu:\t\t0x3f4\r\n\tNazwa procesu:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nInformacje o sieci:\r\n\tNazwa stacji roboczej:\t-\r\n\tŹródłowy adres sieciowy:\t-\r\n\tPort źródłowy:\t\t-\r\n\r\nSzczegółowe informacje o logowaniu:\r\n\tProces logowania:\t\tAdvapi  \r\n\tPakiet uwierzytelniania:\tNegotiate\r\n\tUsługi przejściowe:\t-\r\n\tNazwa pakietu (tylko protokół NTLM):\t-\r\n\tDługość klucza:\t\t0\r\n\r\nTo zdarzenie jest generowane w przypadku utworzenia sesji logowania. Jest ono generowane na komputerze, do którego uzyskano dostęp.\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nPola sieci wskazują lokalizację, z której pochodziło zdalne żądanie logowania. Nazwa stacji roboczej nie jest zawsze dostępna i w niektórych przypadkach jej pole może pozostać puste.\r\n\r\nPoziom personifikacji wskazuje dostępny zakres personifikacji w procesie sesji logowania.\r\n\r\nPola informacji o uwierzytelnianiu zawierają szczegółowe informacje o danym żądaniu logowania.\r\n\t- Identyfikator GUID logowania to unikatowy identyfikator, który może być używany do skorelowania tego zdarzenia ze zdarzeniem centrum dystrybucji kluczy.\r\n\t- Usługi przejściowe wskazują, które usługi pośrednie uczestniczyły w tym żądaniu logowania.\r\n\t- Nazwa pakietu wskazuje, który protokół podrzędny spośród protokołów NTLM został użyty.\r\n\t- Długość klucza wskazuje długość wygenerowanego klucza sesji. Jeśli nie zażądano klucza sesji, będzie to wartość 0.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","logonProcessName":"Advapi","authenticationPackageName":"Negotiate","logonGuid":"{00000000-0000-0000-0000-000000000000}","keyLength":"0","processId":"0x3f4","processName":"C:\\\\Windows\\\\System32\\\\services.exe","impersonationLevel":"%%1833","virtualAccount":"%%1843","targetLinkedLogonId":"0x0","elevatedToken":"%%1842"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:28.192+0000","agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315308.3295644","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4627\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12554\",\"opcode\":\"0\",\"keywords\":\"0x8020000000000000\",\"systemTime\":\"2022-12-06T08:28:28.0890762Z\",\"eventRecordID\":\"10311876\",\"processID\":\"416\",\"threadID\":\"4220\",\"channel\":\"Security\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"Informacje o członkostwie grupy.\\r\\n\\r\\nPodmiot:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tWRKPCSI150$\\r\\n\\tDomena konta:\\t\\tPENTACOMP\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nTyp logowania:\\t\\t\\t5\\r\\n\\r\\nNowe logowanie:\\r\\n\\tIdentyfikator zabezpieczeń:\\t\\tS-1-5-18\\r\\n\\tNazwa konta:\\t\\tSYSTEM\\r\\n\\tDomena konta:\\t\\tZARZĄDZANIE NT\\r\\n\\tIdentyfikator logowania:\\t\\t0x3E7\\r\\n\\r\\nZdarzenie w sekwencji:\\t\\t1 z 1\\r\\n\\r\\nCzłonkostwo grupy:\\t\\t\\t\\r\\n\\t\\t%{S-1-5-32-544}\\r\\n\\t\\t%{S-1-1-0}\\r\\n\\t\\t%{S-1-5-11}\\r\\n\\t\\t%{S-1-16-16384}\\r\\n\\r\\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\\r\\n\\r\\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\\r\\n\\r\\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\\r\\n\\r\\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-5-18\",\"subjectUserName\":\"PC15$\",\"subjectDomainName\":\"DOMAIN\",\"subjectLogonId\":\"0x3e7\",\"targetUserSid\":\"S-1-5-18\",\"targetUserName\":\"SYSTEM\",\"targetDomainName\":\"ZARZĄDZANIE NT\",\"targetLogonId\":\"0x3e7\",\"logonType\":\"5\",\"eventIdx\":\"1\",\"eventCountTotal\":\"1\",\"groupMembership\":\"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4627","version":"0","level":"0","task":"12554","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-12-06T08:28:28.0890762Z","eventRecordID":"10311876","processID":"416","threadID":"4220","channel":"Security","computer":"PC15.DOMAIN.pl","severityValue":"AUDIT_SUCCESS","message":"\"Informacje o członkostwie grupy.\r\n\r\nPodmiot:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tWRKPCSI150$\r\n\tDomena konta:\t\tPENTACOMP\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nTyp logowania:\t\t\t5\r\n\r\nNowe logowanie:\r\n\tIdentyfikator zabezpieczeń:\t\tS-1-5-18\r\n\tNazwa konta:\t\tSYSTEM\r\n\tDomena konta:\t\tZARZĄDZANIE NT\r\n\tIdentyfikator logowania:\t\t0x3E7\r\n\r\nZdarzenie w sekwencji:\t\t1 z 1\r\n\r\nCzłonkostwo grupy:\t\t\t\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}\r\n\r\nPola podmiotu wskazują konto w systemie lokalnym, z poziomu którego zażądano logowania. Najczęściej jest to usługa, taka jak usługa serwera, lub proces lokalny, taki jak Winlogon.exe lub Services.exe.\r\n\r\nPole typu logowania wskazuje rodzaj żądanego logowania. Najczęściej używane typy to 2 (interaktywne) i 3 (sieciowe).\r\n\r\nPola nowego logowania wskazują konto, dla którego utworzono nowe dane logowania, czyli konto, do którego nastąpiło zalogowanie.\r\n\r\nTo zdarzenie jest generowane w przypadku skonfigurowania podkategorii Członkostwo grupy inspekcji. Pole identyfikatora logowania może służyć do skorelowania tego zdarzenia z odpowiednim zdarzeniem logowania użytkownika oraz z innymi zdarzeniami inspekcji wygenerowanymi podczas tej sesji logowania.\""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"PC15$","subjectDomainName":"DOMAIN","subjectLogonId":"0x3e7","targetUserSid":"S-1-5-18","targetUserName":"SYSTEM","targetDomainName":"ZARZĄDZANIE NT","targetLogonId":"0x3e7","logonType":"5","eventIdx":"1","eventCountTotal":"1","groupMembership":"    %{S-1-5-32-544}    %{S-1-1-0}    %{S-1-5-11}    %{S-1-16-16384}"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:44.066+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315324.3295644","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315323.679:22381): pid=9460 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:7b:f3:38:18:84:2e:1b:fc:cd:57:53:57:45:93:74:5e:cb:89:bc:d8:b4:a8:77:d0:15:e7:38:53:5a:3c:77:db direction=? spid=9460 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22381","pid":"9460","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:44.066+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315324.3295644","full_log":"type=CRYPTO_SESSION msg=audit(1670315323.711:22384): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 mac=hmac-sha2-256 pfs=curve25519-sha256 spid=9460 suid=74 rport=42038 laddr=192.168.61.147 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRYPTO_SESSION","id":"22384","pid":"9459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:44.066+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315324.3295644","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315323.680:22382): pid=9460 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:9c:c2:78:e4:35:6d:d6:05:11:1e:97:76:41:80:ae:f4:99:48:88:12:93:ca:76:33:06:06:1c:2f:17:b6:ee:16 direction=? spid=9460 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22382","pid":"9460","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:44.067+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315324.3295644","full_log":"type=CRYPTO_SESSION msg=audit(1670315323.712:22385): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes256-ctr ksize=256 mac=hmac-sha2-256 pfs=curve25519-sha256 spid=9460 suid=74 rport=42038 laddr=192.168.61.147 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRYPTO_SESSION","id":"22385","pid":"9459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:44.066+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315324.3295644","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315323.680:22383): pid=9460 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:b3:26:d6:7c:9b:41:96:25:25:e6:e8:e2:64:2e:3a:70:61:48:fb:94:fb:64:b5:ae:89:4e:56:54:54:02:c0:4d direction=? spid=9460 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22383","pid":"9460","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:50.650+0000","rule":{"level":3,"description":"Software protection service scheduled successfully.","id":"60642","firedtimes":9,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"002","name":"PC15","ip":"192.168.1.102"},"manager":{"name":"wazuh-server"},"id":"1670315330.3303753","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-SPP\",\"providerGuid\":\"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}\",\"eventSourceName\":\"Software Protection Platform Service\",\"eventID\":\"16384\",\"version\":\"0\",\"level\":\"4\",\"task\":\"0\",\"opcode\":\"0\",\"keywords\":\"0x80000000000000\",\"systemTime\":\"2022-12-06T08:28:51.6001999Z\",\"eventRecordID\":\"7361\",\"processID\":\"0\",\"threadID\":\"0\",\"channel\":\"Application\",\"computer\":\"PC15.DOMAIN.pl\",\"severityValue\":\"INFORMATION\",\"message\":\"\\\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-12T08:28:51Z. Przyczyna: RulesEngine.\\\"\"},\"eventdata\":{\"data\":\"2122-11-12T08:28:51Z, RulesEngine\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-SPP","providerGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","eventSourceName":"Software Protection Platform Service","eventID":"16384","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2022-12-06T08:28:51.6001999Z","eventRecordID":"7361","processID":"0","threadID":"0","channel":"Application","computer":"PC15.DOMAIN.pl","severityValue":"INFORMATION","message":"\"Zaplanowano restart usługi ochrony oprogramowania o 2122-11-12T08:28:51Z. Przyczyna: RulesEngine.\""},"eventdata":{"data":"2122-11-12T08:28:51Z, RulesEngine"}}},"location":"EventChannel"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=USER_AUTH msg=audit(1670315334.092:22386): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_AUTH","id":"22386","pid":"9459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=CRED_ACQ msg=audit(1670315334.110:22390): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRED_ACQ","id":"22390","pid":"9459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=LOGIN msg=audit(1670315334.110:22391): pid=9459 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=1000 tty=(none) old-ses=4294967295 ses=3094 res=1","decoder":{"parent":"auditd","name":"auditd"},"data":{"audit":{"type":"LOGIN","id":"22391","pid":"9459","uid":"0","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=USER_AUTH msg=audit(1670315334.109:22389): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_AUTH","id":"22389","pid":"9459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=USER_ROLE_CHANGE msg=audit(1670315334.278:22392): pid=9459 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_ROLE_CHANGE","id":"22392","pid":"9459","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=USER_START msg=audit(1670315334.300:22393): pid=9459 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_START","id":"22393","pid":"9459","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=USER_ACCT msg=audit(1670315334.106:22387): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_ACCT","id":"22387","pid":"9459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315334.302:22394): pid=9464 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:7b:f3:38:18:84:2e:1b:fc:cd:57:53:57:45:93:74:5e:cb:89:bc:d8:b4:a8:77:d0:15:e7:38:53:5a:3c:77:db direction=? spid=9464 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22394","pid":"9464","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315334.106:22388): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=9460 suid=74 rport=42038 laddr=192.168.61.147 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=192.168.136.52 terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRYPTO_KEY_USER","id":"22388","pid":"9459","uid":"0","auid":"4294967295","session":"4294967295","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315334.302:22396): pid=9464 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:b3:26:d6:7c:9b:41:96:25:25:e6:e8:e2:64:2e:3a:70:61:48:fb:94:fb:64:b5:ae:89:4e:56:54:54:02:c0:4d direction=? spid=9464 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22396","pid":"9464","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=USER_LOGIN msg=audit(1670315334.412:22398): pid=9459 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_LOGIN","id":"22398","pid":"9459","auid":"1000","uid":"0","session":"3094","exe":"/usr/sbin/sshd","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315334.302:22395): pid=9464 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:9c:c2:78:e4:35:6d:d6:05:11:1e:97:76:41:80:ae:f4:99:48:88:12:93:ca:76:33:06:06:1c:2f:17:b6:ee:16 direction=? spid=9464 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22395","pid":"9464","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=CRED_ACQ msg=audit(1670315334.303:22397): pid=9464 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"wazuh-user\" exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"CRED_ACQ","id":"22397","pid":"9464","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=USER_START msg=audit(1670315334.412:22399): pid=9459 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe=\"/usr/sbin/sshd\" hostname=192.168.136.52 addr=192.168.136.52 terminal=ssh res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"192.168.136.52","audit":{"type":"USER_START","id":"22399","pid":"9459","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"type=CRYPTO_KEY_USER msg=audit(1670315334.418:22400): pid=9459 uid=0 auid=1000 ses=3094 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:b3:26:d6:7c:9b:41:96:25:25:e6:e8:e2:64:2e:3a:70:61:48:fb:94:fb:64:b5:ae:89:4e:56:54:54:02:c0:4d direction=? spid=9465 suid=1000  exe=\"/usr/sbin/sshd\" hostname=? addr=? terminal=? res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRYPTO_KEY_USER","id":"22400","pid":"9459","uid":"0","auid":"1000","session":"3094","subj":"system_u:system_r:sshd_t:s0-s0:c0.c1023","exe":"/usr/sbin/sshd"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:28:56.080+0000","rule":{"level":3,"description":"PAM: Login session opened.","id":"5501","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":2,"mail":false,"groups":["pam","syslog","authentication_success"],"pci_dss":["10.2.5"],"gpg13":["7.8","7.9"],"gdpr":["IV_32.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"Dec  6 08:28:54 wazuh-server sshd[9459]: pam_unix(sshd:session): session opened for user wazuh-user by (uid=0)","predecoder":{"program_name":"sshd","timestamp":"Dec  6 08:28:54","hostname":"wazuh-server"},"decoder":{"parent":"pam","name":"pam"},"data":{"dstuser":"wazuh-user","uid":"0"},"location":"/var/log/secure"}
{"timestamp":"2022-12-06T08:28:56.080+0000","rule":{"level":3,"description":"sshd: authentication success.","id":"5715","mitre":{"id":["T1078","T1021"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Lateral Movement"],"technique":["Valid Accounts","Remote Services"]},"firedtimes":2,"mail":false,"groups":["syslog","sshd","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315336.3303753","full_log":"Dec  6 08:28:54 wazuh-server sshd[9459]: Accepted password for wazuh-user from 192.168.136.52 port 42038 ssh2","predecoder":{"program_name":"sshd","timestamp":"Dec  6 08:28:54","hostname":"wazuh-server"},"decoder":{"parent":"sshd","name":"sshd"},"data":{"srcip":"192.168.136.52","srcport":"42038","dstuser":"wazuh-user"},"location":"/var/log/secure"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=USER_AUTH msg=audit(1670315338.282:22406): pid=9478 uid=0 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_rootok acct=\"root\" exe=\"/usr/bin/su\" hostname=wazuh-server addr=? terminal=pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_AUTH","id":"22406","pid":"9478","uid":"0","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/bin/su"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=USER_START msg=audit(1670315338.274:22405): pid=9474 uid=0 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix acct=\"root\" exe=\"/usr/bin/sudo\" hostname=? addr=? terminal=/dev/pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22405","pid":"9474","uid":"0","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/bin/sudo"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=CRED_REFR msg=audit(1670315338.267:22404): pid=9474 uid=0 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"root\" exe=\"/usr/bin/sudo\" hostname=? addr=? terminal=/dev/pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_REFR","id":"22404","pid":"9474","uid":"0","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/bin/sudo"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=USER_ACCT msg=audit(1670315338.282:22407): pid=9478 uid=0 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_succeed_if acct=\"root\" exe=\"/usr/bin/su\" hostname=wazuh-server addr=? terminal=pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22407","pid":"9478","uid":"0","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/bin/su"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=USER_AUTH msg=audit(1670315338.260:22401): pid=9474 uid=1000 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct=\"wazuh-user\" exe=\"/usr/bin/sudo\" hostname=? addr=? terminal=/dev/pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_AUTH","id":"22401","pid":"9474","uid":"1000","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/bin/sudo"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=CRED_ACQ msg=audit(1670315338.282:22408): pid=9478 uid=0 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_rootok acct=\"root\" exe=\"/usr/bin/su\" hostname=wazuh-server addr=? terminal=pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"CRED_ACQ","id":"22408","pid":"9478","uid":"0","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/bin/su"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=USER_CMD msg=audit(1670315338.267:22403): pid=9474 uid=1000 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd=\"/home/wazuh-user\" cmd=\"su\" terminal=pts/0 res=success'","decoder":{"name":"auditd"},"data":{"audit":{"type":"USER_CMD","id":"22403","pid":"9474","auid":"1000","uid":"1000","session":"3092","res":"success"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"type=USER_START msg=audit(1670315338.284:22409): pid=9478 uid=0 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_xauth acct=\"root\" exe=\"/usr/bin/su\" hostname=wazuh-server addr=? terminal=pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_START","id":"22409","pid":"9478","uid":"0","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"root","exe":"/usr/bin/su"}},"location":"/var/log/audit/audit.log"}
{"timestamp":"2022-12-06T08:29:00.084+0000","rule":{"level":3,"description":"PAM: Login session opened.","id":"5501","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":3,"mail":false,"groups":["pam","syslog","authentication_success"],"pci_dss":["10.2.5"],"gpg13":["7.8","7.9"],"gdpr":["IV_32.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"Dec  6 08:28:58 wazuh-server sudo: pam_unix(sudo:session): session opened for user root by wazuh-user(uid=0)","predecoder":{"program_name":"sudo","timestamp":"Dec  6 08:28:58","hostname":"wazuh-server"},"decoder":{"parent":"pam","name":"pam"},"data":{"srcuser":"wazuh-user","dstuser":"root","uid":"0"},"location":"/var/log/secure"}
{"timestamp":"2022-12-06T08:29:00.084+0000","rule":{"level":3,"description":"Successful sudo to ROOT executed.","id":"5402","mitre":{"id":["T1548.003"],"tactic":["Privilege Escalation","Defense Evasion"],"technique":["Sudo and Sudo Caching"]},"firedtimes":1,"mail":false,"groups":["syslog","sudo"],"pci_dss":["10.2.5","10.2.2"],"gpg13":["7.6","7.8","7.13"],"gdpr":["IV_32.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7","AC.6"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"Dec  6 08:28:58 wazuh-server sudo: wazuh-user : TTY=pts/0 ; PWD=/home/wazuh-user ; USER=root ; COMMAND=/bin/su","predecoder":{"program_name":"sudo","timestamp":"Dec  6 08:28:58","hostname":"wazuh-server"},"decoder":{"parent":"sudo","name":"sudo","ftscomment":"First time user executed the sudo command"},"data":{"srcuser":"wazuh-user","dstuser":"root","tty":"pts/0","pwd":"/home/wazuh-user","command":"/bin/su"},"location":"/var/log/secure"}
{"timestamp":"2022-12-06T08:29:00.084+0000","rule":{"level":3,"description":"PAM: Login session opened.","id":"5501","mitre":{"id":["T1078"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Valid Accounts"]},"firedtimes":4,"mail":false,"groups":["pam","syslog","authentication_success"],"pci_dss":["10.2.5"],"gpg13":["7.8","7.9"],"gdpr":["IV_32.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"Dec  6 08:28:58 wazuh-server su: pam_unix(su:session): session opened for user root by wazuh-user(uid=0)","predecoder":{"program_name":"su","timestamp":"Dec  6 08:28:58","hostname":"wazuh-server"},"decoder":{"parent":"pam","name":"pam"},"data":{"srcuser":"wazuh-user","dstuser":"root","uid":"0"},"location":"/var/log/secure"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3305772","full_log":"Dec  6 08:28:58 wazuh-server su: (to root) wazuh-user on pts/0","predecoder":{"program_name":"su","timestamp":"Dec  6 08:28:58","hostname":"wazuh-server"},"decoder":{"parent":"su","name":"su"},"location":"/var/log/messages"}
{"timestamp":"2022-12-06T08:29:00.084+0000","agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1670315340.3306742","full_log":"type=USER_ACCT msg=audit(1670315338.266:22402): pid=9474 uid=1000 auid=1000 ses=3092 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct=\"wazuh-user\" exe=\"/usr/bin/sudo\" hostname=? addr=? terminal=/dev/pts/0 res=success'","decoder":{"parent":"auditd","name":"auditd"},"data":{"srcip":"?","audit":{"type":"USER_ACCT","id":"22402","pid":"9474","uid":"1000","auid":"1000","session":"3092","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","acct":"wazuh-user","exe":"/usr/bin/sudo"}},"location":"/var/log/audit/audit.log"}
