{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t2264\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe\n\nNetwork Information:\n\tDirection:\t\tOutbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t61695\n\tDestination Address:\t::1\n\tDestination Port:\t\t389\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t65788\n\tLayer Name:\t\tConnect\n\tLayer Run-Time ID:\t50","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:27.037Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"cc4934033e8ad15d4e9b83e6b77e5536eb37eb0910febce5b0d5b48e408c3012","outcome":"success","created":"2025-12-09T03:41:28.162Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328257,"event_id":5156,"process":{"thread":{"id":6060},"pid":4},"version":1,"event_data":{"LayerRTID":"50","SourceAddress":"::1","Application":"\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe","DestPort":"389","Protocol":"6","RemoteMachineID":"S-1-0-0","ProcessID":"2264","DestAddress":"::1","Direction":"%%14593","LayerName":"%%14611","RemoteUserID":"S-1-0-0","FilterRTID":"65788","SourcePort":"61695"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a bind to a local port.\n\nApplication Information:\n\tProcess ID:\t\t2264\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe\n\nNetwork Information:\n\tSource Address:\t\t::\n\tSource Port:\t\t61695\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t0\n\tLayer Name:\t\tResource Assignment\n\tLayer Run-Time ID:\t38","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:27.037Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5158,"hash":"69b9d8365c420fc23ffdabc9a0ff004322488c712dfa2738f350a8f107251f8e","outcome":"success","created":"2025-12-09T03:41:28.162Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328256,"event_id":5158,"process":{"thread":{"id":6060},"pid":4},"event_data":{"LayerRTID":"38","ProcessId":"2264","LayerName":"%%14608","SourceAddress":"::","Application":"\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe","Protocol":"6","FilterRTID":"0","SourcePort":"61695"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t692\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\lsass.exe\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t61695\n\tDestination Address:\t::1\n\tDestination Port:\t\t389\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t65786\n\tLayer Name:\t\tReceive/Accept\n\tLayer Run-Time ID:\t46","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:27.038Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"8f6a55d5b02e2cd72fef234950304c7de36c81065e035b0891fcff1893e48ab2","outcome":"success","created":"2025-12-09T03:41:28.162Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328258,"event_id":5156,"process":{"thread":{"id":6060},"pid":4},"version":1,"event_data":{"LayerRTID":"46","SourceAddress":"::1","DestAddress":"::1","Protocol":"6","RemoteMachineID":"S-1-0-0","DestPort":"389","ProcessID":"692","Application":"\\device\\harddiskvolume2\\windows\\system32\\lsass.exe","Direction":"%%14592","LayerName":"%%14610","RemoteUserID":"S-1-0-0","FilterRTID":"65786","SourcePort":"61695"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0xDFEBABF\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:27.039Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Special Logon","kind":"event","code":4672,"hash":"962a02d056a46c742150a7eb62140d7023106a9201c6947dd5b729dc074f08de","outcome":"success","created":"2025-12-09T03:41:28.162Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328259,"event_id":4672,"process":{"thread":{"id":4888},"pid":692},"event_data":{"PrivilegeList":"SeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","SubjectUserSid":"S-1-5-18","SubjectLogonId":"0xdfebabf","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Special Logon"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0xDFEBABF\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:27.041Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Logoff","kind":"event","code":4634,"hash":"bf20d8fc589626db1b6fadedd431858df812ac50ef7d1f414a237e10356230a2","outcome":"success","created":"2025-12-09T03:41:28.162Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328262,"event_id":4634,"process":{"thread":{"id":4260},"pid":692},"event_data":{"TargetDomainName":"TDARPLATFORM","TargetLogonId":"0xdfebabf","LogonType":"3","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetUserSid":"S-1-5-18"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Logoff"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t3\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM.CSOC\n\tLogon ID:\t\t0xDFEBABF\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{6A75CB6E-BE25-A65F-629A-5616EAFD4D81}\n\nProcess Information:\n\tProcess ID:\t\t0x0\n\tProcess Name:\t\t-\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t::1\n\tSource Port:\t\t61695\n\nDetailed Authentication Information:\n\tLogon Process:\t\tKerberos\n\tAuthentication Package:\tKerberos\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:27.039Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Logon","kind":"event","code":4624,"hash":"9df241ff4f266dae2db29f7dd2eba0e6b25753bfef0a1b61c6c7caf49a789b36","outcome":"success","created":"2025-12-09T03:41:28.162Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328260,"event_id":4624,"process":{"thread":{"id":4888},"pid":692},"version":2,"event_data":{"VirtualAccount":"%%1843","TargetUserName":"WIN-MDLQ2GQ94V9$","LogonProcessName":"Kerberos","SubjectDomainName":"-","IpAddress":"::1","SubjectUserName":"-","TargetOutboundUserName":"-","LogonGuid":"{6A75CB6E-BE25-A65F-629A-5616EAFD4D81}","ImpersonationLevel":"%%1833","TargetLogonId":"0xdfebabf","SubjectLogonId":"0x0","IpPort":"61695","TargetUserSid":"S-1-5-18","LmPackageName":"-","ProcessName":"-","SubjectUserSid":"S-1-0-0","ProcessId":"0x0","TargetOutboundDomainName":"-","KeyLength":"0","TargetDomainName":"TDARPLATFORM.CSOC","TargetLinkedLogonId":"0x0","LogonType":"3","AuthenticationPackageName":"Kerberos","TransmittedServices":"-","RestrictedAdminMode":"-","WorkstationName":"-","ElevatedToken":"%%1842"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Logon"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has blocked a packet.\n\nApplication Information:\n\tProcess ID:\t\t0\n\tApplication Name:\t-\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t172.30.2.163\n\tSource Port:\t\t1515\n\tDestination Address:\t172.30.4.205\n\tDestination Port:\t\t61694\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t67142\n\tLayer Name:\t\tICMP Error\n\tLayer Run-Time ID:\t28","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:27.388Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Packet Drop","kind":"event","code":5152,"hash":"620841373843d11cc838d128f525b1e8c929fb3c6056141350d1993a06f7ccf1","outcome":"failure","created":"2025-12-09T03:41:28.162Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328263,"event_id":5152,"process":{"thread":{"id":6060},"pid":4},"event_data":{"ProcessId":"0","LayerRTID":"28","Application":"-","DestAddress":"172.30.4.205","DestPort":"61694","Protocol":"6","SourceAddress":"172.30.2.163","Direction":"%%14592","LayerName":"%%14601","FilterRTID":"67142","SourcePort":"1515"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Failure"],"opcode":"Info","task":"Filtering Platform Packet Drop"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:26.898Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:41:28.591Z"},"event_type":"windows","host":{"id":"9ca2332f-614b-4da2-897e-35dfbc072591","architecture":"x86_64","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"name":"w2016ad-n25.tdarplatform.csoc","hostname":"w2016ad-n25","mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225277937,"event_id":4703,"process":{"thread":{"id":3548},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","ProcessId":"0x11c","SubjectUserSid":"S-1-5-18","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:26.902Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:41:28.591Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","hostname":"w2016ad-n25","mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225277939,"event_id":4703,"process":{"thread":{"id":3548},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:26.899Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:41:28.591Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225277938,"event_id":4703,"process":{"thread":{"id":3548},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","ProcessId":"0x11c","SubjectUserSid":"S-1-5-18","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:26.912Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:41:28.591Z"},"event_type":"windows","host":{"id":"9ca2332f-614b-4da2-897e-35dfbc072591","architecture":"x86_64","name":"w2016ad-n25.tdarplatform.csoc","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225277940,"event_id":4703,"process":{"thread":{"id":3548},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"w2016ad-n25","ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:26.913Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:41:28.591Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"hostname":"w2016ad-n25","mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225277941,"event_id":4703,"process":{"thread":{"id":3548},"pid":4},"event_data":{"ProcessId":"0x11c","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{42B4E50D-3879-4B45-A1C5-72FF2BF4B1CA}\n\tName:\t\tCore Networking - Teredo (UDP-In)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829142\n\nLayer Information:\n\tID:\t\t{1247D66D-0B60-4A15-8D44-7155D0F53A0C}\n\tName:\t\tALE Resource Assignment v4 Layer\n\tRun-Time ID:\t36\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t11529003905476198400\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.172Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"b2440c035333d245fe143ec14413996006e8bb7df4c0c48819b07ed0919ff230","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328267,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{42B4E50D-3879-4B45-A1C5-72FF2BF4B1CA}","LayerId":"36","Weight":"11529003905476198400","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829142","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11","FilterType":"%%16388","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","LayerName":"ALE Resource Assignment v4 Layer","LayerKey":"{1247D66D-0B60-4A15-8D44-7155D0F53A0C}","UserSid":"S-1-5-19","CalloutName":"-","ChangeType":"%%16384","FilterName":"Core Networking - Teredo (UDP-In)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{693ED5B0-929C-47F2-A56F-065BC1E72261}\n\tName:\t\tFile and Printer Sharing (Spooler Service - RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829146\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364512\t\n\tConditions:\t\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.172Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"c521f8e5be5d45573076285561515e530587054b103be7f35b3c5a72a72b1e58","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328271,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"40","Weight":"10376293542535364512","FilterKey":"{693ED5B0-929C-47F2-A56F-065BC1E72261}","Action":"%%16390","FilterId":"829146","Conditions":"\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","CalloutKey":"{00000000-0000-0000-0000-000000000000}","LayerName":"ALE Listen v4 Layer","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","ChangeType":"%%16384","CalloutName":"-","FilterName":"File and Printer Sharing (Spooler Service - RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{3FA295E1-E399-4B4B-93C9-CB9E64E8824D}\n\tName:\t\tFile and Printer Sharing (Spooler Service - RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829151\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376539900785721344\t\n\tConditions:\t\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.173Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"e30dd6fa690e702782c30642113888861d1173710515455fa2c76eafee55e35b","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328276,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"46","Weight":"10376539900785721344","FilterKey":"{3FA295E1-E399-4B4B-93C9-CB9E64E8824D}","Action":"%%16390","FilterId":"829151","Conditions":"\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerName":"ALE Receive/Accept v6 Layer","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","CalloutName":"-","ChangeType":"%%16384","FilterName":"File and Printer Sharing (Spooler Service - RPC-EPMAP)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{7B2A55D6-AC27-40C5-B4C5-3DCFD99157DB}\n\tName:\t\tRPC Endpoint Mapper (TCP, Incoming)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829158\n\nLayer Information:\n\tID:\t\t{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}\n\tName:\t\tALE Listen v6 Layer\n\tRun-Time ID:\t42\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293541528731616\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.173Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"b0497b34faa8284ab1eb6be8f9bc7a18fa94f534f0501e3f3707f5766709f6e8","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328283,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"42","Weight":"10376293541528731616","FilterKey":"{7B2A55D6-AC27-40C5-B4C5-3DCFD99157DB}","Action":"%%16390","FilterId":"829158","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerName":"ALE Listen v6 Layer","LayerKey":"{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ChangeType":"%%16384","CalloutName":"-","FilterName":"RPC Endpoint Mapper (TCP, Incoming)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{9DE4B0CF-DA68-4D5E-A816-24AB916C17E7}\n\tName:\t\tMicrosoft Key Distribution Service\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829165\n\nLayer Information:\n\tID:\t\t{E1CD9FE7-F4B5-4273-96C0-592E487B8650}\n\tName:\t\tALE Receive/Accept v4 Layer\n\tRun-Time ID:\t44\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10378405428420673536\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.173Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"eba361282641c9c3ff9a2654ce848d66ca8159867f831c508d92be231708f9f1","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328290,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{9DE4B0CF-DA68-4D5E-A816-24AB916C17E7}","LayerId":"44","Weight":"10378405428420673536","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829165","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","LayerKey":"{E1CD9FE7-F4B5-4273-96C0-592E487B8650}","LayerName":"ALE Receive/Accept v4 Layer","ChangeType":"%%16384","CalloutName":"-","FilterName":"Microsoft Key Distribution Service"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{320E8792-1E7D-4D00-8F56-2402EFC9FF6F}\n\tName:\t\tDFS Replication (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829172\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364576\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.174Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"8c4c194c693a81bacb3f87b35e643e1bc32a0bf2b5f1dbea59f4b02c41d6d1b0","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328297,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"40","FilterKey":"{320E8792-1E7D-4D00-8F56-2402EFC9FF6F}","Weight":"10376293542535364576","Action":"%%16390","FilterId":"829172","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251","FilterType":"%%16388","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","LayerName":"ALE Listen v4 Layer","ProviderName":"Microsoft Corporation","UserSid":"S-1-5-19","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ChangeType":"%%16384","CalloutName":"-","FilterName":"DFS Replication (RPC-EPMAP)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{A4A1E22E-D350-44BF-A301-2986FB88B130}\n\tName:\t\tCore Networking - Teredo (UDP-In)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829143\n\nLayer Information:\n\tID:\t\t{E1CD9FE7-F4B5-4273-96C0-592E487B8650}\n\tName:\t\tALE Receive/Accept v4 Layer\n\tRun-Time ID:\t44\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10378405428420673536\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.172Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"fce1cc604d1b7ef9393454ecd2d8bcee6ae75d5113c50e0cbe9855673586cec8","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328268,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"44","Weight":"10378405428420673536","FilterKey":"{A4A1E22E-D350-44BF-A301-2986FB88B130}","Action":"%%16390","FilterId":"829143","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11","FilterType":"%%16388","LayerKey":"{E1CD9FE7-F4B5-4273-96C0-592E487B8650}","ProviderName":"Microsoft Corporation","LayerName":"ALE Receive/Accept v4 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","CalloutName":"-","ChangeType":"%%16384","FilterName":"Core Networking - Teredo (UDP-In)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{757FB862-4F47-4D71-8D2B-07EF4D5BFE03}\n\tName:\t\tFile Replication (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829179\n\nLayer Information:\n\tID:\t\t{E1CD9FE7-F4B5-4273-96C0-592E487B8650}\n\tName:\t\tALE Receive/Accept v4 Layer\n\tRun-Time ID:\t44\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10378405428420673536\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.174Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"b7a52da8e069bcd395b6f1a81d96479991e5616ed33108d80ed75637e23344eb","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328304,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"44","Weight":"10378405428420673536","FilterKey":"{757FB862-4F47-4D71-8D2B-07EF4D5BFE03}","Action":"%%16390","FilterId":"829179","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerKey":"{E1CD9FE7-F4B5-4273-96C0-592E487B8650}","ProviderName":"Microsoft Corporation","LayerName":"ALE Receive/Accept v4 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","ChangeType":"%%16384","CalloutName":"-","FilterName":"File Replication (RPC-EPMAP)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{DD3BBADE-192E-4984-9996-D8CBA3ABFFD2}\n\tName:\t\tActive Directory Domain Controller (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829186\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364576\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.175Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"380c71c699119755892ca4c14f375690a4ea442d51fb6fdaf77ff5295535bdb2","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328311,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{DD3BBADE-192E-4984-9996-D8CBA3ABFFD2}","LayerId":"40","Weight":"10376293542535364576","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829186","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","CalloutKey":"{00000000-0000-0000-0000-000000000000}","LayerName":"ALE Listen v4 Layer","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","CalloutName":"-","ChangeType":"%%16384","FilterName":"Active Directory Domain Controller (RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{0FA59338-31C8-48FC-9E99-F91CAA05905B}\n\tName:\t\tActive Directory Domain Controller (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829193\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376540038224674816\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.175Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"32a5c0d3cb13abd5d2e5753c9d45169e3f12d17c9b0a69b569e25c6f0ba20270","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328318,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"46","FilterKey":"{0FA59338-31C8-48FC-9E99-F91CAA05905B}","Weight":"10376540038224674816","Action":"%%16390","FilterId":"829193","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","ProviderName":"Microsoft Corporation","UserSid":"S-1-5-19","LayerName":"ALE Receive/Accept v6 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","CalloutName":"-","ChangeType":"%%16384","FilterName":"Active Directory Domain Controller (RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{E511434D-E5A1-4F65-B235-C55BA28722AE}\n\tName:\t\tFile and Printer Sharing (Spooler Service - RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829096\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364512\t\n\tConditions:\t\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.176Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"11abadff9c5a3b102fe56670725a5a1e58261f77a118b1dd2bf0630e5f2a9067","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328325,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","FilterKey":"{E511434D-E5A1-4F65-B235-C55BA28722AE}","LayerId":"40","Weight":"10376293542535364512","Action":"%%16390","FilterId":"829096","Conditions":"\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251","FilterType":"%%16388","LayerName":"ALE Listen v4 Layer","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","UserSid":"S-1-5-19","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ProviderName":"Microsoft Corporation","ChangeType":"%%16385","CalloutName":"-","FilterName":"File and Printer Sharing (Spooler Service - RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{2A77CF1B-C5C7-4435-ACAD-24790B6238CE}\n\tName:\t\tRPC Endpoint Mapper (TCP, Incoming)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829103\n\nLayer Information:\n\tID:\t\t{E1CD9FE7-F4B5-4273-96C0-592E487B8650}\n\tName:\t\tALE Receive/Accept v4 Layer\n\tRun-Time ID:\t44\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10378405428420673536\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.176Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"5510bcd6f56a25d25ec85eb780385f5c8f87f95b64301a6d5509753b4254df95","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328332,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{2A77CF1B-C5C7-4435-ACAD-24790B6238CE}","LayerId":"44","Weight":"10378405428420673536","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829103","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","LayerName":"ALE Receive/Accept v4 Layer","UserSid":"S-1-5-19","LayerKey":"{E1CD9FE7-F4B5-4273-96C0-592E487B8650}","ChangeType":"%%16385","CalloutName":"-","FilterName":"RPC Endpoint Mapper (TCP, Incoming)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{958D83C5-AE84-48AC-B214-E6F12952C7D2}\n\tName:\t\tMicrosoft Key Distribution Service\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829110\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364576\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.176Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"fd1d0e85a220ceaaa51572ebe91737b2ab193a3be4650af580fb47a7ad12470e","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328339,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"40","FilterKey":"{958D83C5-AE84-48AC-B214-E6F12952C7D2}","Weight":"10376293542535364576","Action":"%%16390","FilterId":"829110","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","LayerName":"ALE Listen v4 Layer","ChangeType":"%%16385","CalloutName":"-","FilterName":"Microsoft Key Distribution Service"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{320E5707-6993-449B-A8B6-2802B6979AB8}\n\tName:\t\tCore Networking - Teredo (UDP-In)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829144\n\nLayer Information:\n\tID:\t\t{55A650E1-5F0A-4ECA-A653-88F53B26AA8C}\n\tName:\t\tALE Resource Assignment v6 Layer\n\tRun-Time ID:\t38\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t11528792696164450304\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.172Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"5c1ef98424c00c77a8ce8222ba236d10fa6c0b9810d9ec344483d88225e41907","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328269,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{320E5707-6993-449B-A8B6-2802B6979AB8}","LayerId":"38","Weight":"11528792696164450304","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829144","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11","FilterType":"%%16388","LayerName":"ALE Resource Assignment v6 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","LayerKey":"{55A650E1-5F0A-4ECA-A653-88F53B26AA8C}","ProviderName":"Microsoft Corporation","ChangeType":"%%16384","CalloutName":"-","FilterName":"Core Networking - Teredo (UDP-In)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{B1F0102C-A1AD-4459-A8C5-4837CAC28B46}\n\tName:\t\tCore Networking - Teredo (UDP-In)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829145\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376540038224674816\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.172Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"38224fc5aded1c17af323dba21b1842bf002f735dcab4553741b9771726a6fb6","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328270,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{B1F0102C-A1AD-4459-A8C5-4837CAC28B46}","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"46","Weight":"10376540038224674816","Action":"%%16390","FilterId":"829145","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0xd8b6\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x11","FilterType":"%%16388","ProviderName":"Microsoft Corporation","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","UserSid":"S-1-5-19","LayerName":"ALE Receive/Accept v6 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","CalloutName":"-","ChangeType":"%%16384","FilterName":"Core Networking - Teredo (UDP-In)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{F191744F-C5B6-4ACF-81B7-2E00C237AE81}\n\tName:\t\tFile and Printer Sharing (Spooler Service - RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829149\n\nLayer Information:\n\tID:\t\t{E1CD9FE7-F4B5-4273-96C0-592E487B8650}\n\tName:\t\tALE Receive/Accept v4 Layer\n\tRun-Time ID:\t44\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10378404878664859648\t\n\tConditions:\t\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.172Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"fabd9994f196477893d525c9900a94af8f5b260132d4447534ce694d145f6160","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328274,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{F191744F-C5B6-4ACF-81B7-2E00C237AE81}","LayerId":"44","Weight":"10378404878664859648","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829149","Conditions":"\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerName":"ALE Receive/Accept v4 Layer","LayerKey":"{E1CD9FE7-F4B5-4273-96C0-592E487B8650}","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ChangeType":"%%16384","CalloutName":"-","FilterName":"File and Printer Sharing (Spooler Service - RPC-EPMAP)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{058B40AC-EFEE-4A38-903C-EDF8A48B2170}\n\tName:\t\tRPC Endpoint Mapper (TCP, Incoming)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829156\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364576\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.173Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"614c2fb3ceb4b12646ed79cc0ebe7b19190cd7ebf7572a85635cada9cef1d72e","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328281,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{058B40AC-EFEE-4A38-903C-EDF8A48B2170}","LayerId":"40","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Weight":"10376293542535364576","Action":"%%16390","FilterId":"829156","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251","FilterType":"%%16388","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ProviderName":"Microsoft Corporation","UserSid":"S-1-5-19","LayerName":"ALE Listen v4 Layer","ChangeType":"%%16384","CalloutName":"-","FilterName":"RPC Endpoint Mapper (TCP, Incoming)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{8E207BBF-0A51-4CCA-B4CF-3997E9CC6D03}\n\tName:\t\tMicrosoft Key Distribution Service\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829163\n\nLayer Information:\n\tID:\t\t{E1CD9FE7-F4B5-4273-96C0-592E487B8650}\n\tName:\t\tALE Receive/Accept v4 Layer\n\tRun-Time ID:\t44\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10378405428420673536\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.173Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"8da24543f22a3fdd13607a28f29256de081baa91699d3dd7992f6c63964867f6","outcome":"success","created":"2025-12-09T03:41:35.322Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328288,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","FilterKey":"{8E207BBF-0A51-4CCA-B4CF-3997E9CC6D03}","LayerId":"44","Weight":"10378405428420673536","Action":"%%16390","FilterId":"829163","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerName":"ALE Receive/Accept v4 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","LayerKey":"{E1CD9FE7-F4B5-4273-96C0-592E487B8650}","ChangeType":"%%16384","CalloutName":"-","FilterName":"Microsoft Key Distribution Service"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{2B05D0D1-0926-40F0-BB88-0D345C3E1802}\n\tName:\t\tDFS Replication (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829170\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364576\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.174Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"fa42f8e227f5d35c163fb4ebb97f7a3021991dea73adb30ff0c189982b05a9e7","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328295,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{2B05D0D1-0926-40F0-BB88-0D345C3E1802}","LayerId":"40","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Weight":"10376293542535364576","Action":"%%16390","FilterId":"829170","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","LayerName":"ALE Listen v4 Layer","UserSid":"S-1-5-19","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ProviderName":"Microsoft Corporation","ChangeType":"%%16384","CalloutName":"-","FilterName":"DFS Replication (RPC-EPMAP)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{247FFDF3-7381-4853-A025-0B4495D9DD10}\n\tName:\t\tDFS Replication (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829177\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376540038224674816\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.174Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"c019277283e0e29ce04c5f0d804eae4f252edd4a997a9eff2449947193ed7eba","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328302,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{247FFDF3-7381-4853-A025-0B4495D9DD10}","LayerId":"46","Weight":"10376540038224674816","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829177","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","ProviderName":"Microsoft Corporation","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","LayerName":"ALE Receive/Accept v6 Layer","UserSid":"S-1-5-19","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ChangeType":"%%16384","CalloutName":"-","FilterName":"DFS Replication (RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{763AD30C-A424-4D84-B57E-A3AB6869CFCC}\n\tName:\t\tFile Replication (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829184\n\nLayer Information:\n\tID:\t\t{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}\n\tName:\t\tALE Listen v6 Layer\n\tRun-Time ID:\t42\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293541528731616\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.175Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"a296bfe779b6e38d52dedab99f46496fe59e12b1ab05cb21431329ca2ae54192","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328309,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{763AD30C-A424-4D84-B57E-A3AB6869CFCC}","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Weight":"10376293541528731616","LayerId":"42","Action":"%%16390","FilterId":"829184","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251","FilterType":"%%16388","LayerKey":"{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}","LayerName":"ALE Listen v6 Layer","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","ChangeType":"%%16384","CalloutName":"-","FilterName":"File Replication (RPC-EPMAP)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tAdd\n\nFilter Information:\n\tID:\t\t{EB6ABED8-322D-436E-9EC7-AA0E579310DF}\n\tName:\t\tActive Directory Domain Controller (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829191\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376540038224674816\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.175Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"02bf91686e268fa446793346e812ce4e4c4b65099cf0ac8d885191bbb7f29ce8","outcome":"success","created":"2025-12-09T03:41:35.323Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328316,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"46","Weight":"10376540038224674816","FilterKey":"{EB6ABED8-322D-436E-9EC7-AA0E579310DF}","Action":"%%16390","FilterId":"829191","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","LayerName":"ALE Receive/Accept v6 Layer","ProviderName":"Microsoft Corporation","UserSid":"S-1-5-19","CalloutKey":"{00000000-0000-0000-0000-000000000000}","CalloutName":"-","ChangeType":"%%16384","FilterName":"Active Directory Domain Controller (RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{4E80E230-8145-466B-A392-98ADA75E6354}\n\tName:\t\tFile and Printer Sharing (Spooler Service - RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829094\n\nLayer Information:\n\tID:\t\t{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}\n\tName:\t\tALE Listen v4 Layer\n\tRun-Time ID:\t40\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293542535364512\t\n\tConditions:\t\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.175Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"61d3f20d508f17a8bcff033b256a9e1c475814895a63df4410b83b8c97e0a8b8","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328323,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","FilterKey":"{4E80E230-8145-466B-A392-98ADA75E6354}","Weight":"10376293542535364512","LayerId":"40","Action":"%%16390","FilterId":"829094","Conditions":"\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerName":"ALE Listen v4 Layer","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","LayerKey":"{88BB5DAD-76D7-4227-9C71-DF0A3ED7BE7E}","UserSid":"S-1-5-19","CalloutName":"-","ChangeType":"%%16385","FilterName":"File and Printer Sharing (Spooler Service - RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{EBF86D10-7DB6-4855-8E94-DC3793E9A8F7}\n\tName:\t\tFile and Printer Sharing (Spooler Service - RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829101\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376539900785721344\t\n\tConditions:\t\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.176Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"b393949d57c283a0f527e0ac4411ddaf03b6032fa434eb238084113dbf172774","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328330,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{EBF86D10-7DB6-4855-8E94-DC3793E9A8F7}","LayerId":"46","Weight":"10376539900785721344","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829101","Conditions":"\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerName":"ALE Receive/Accept v6 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","ChangeType":"%%16385","CalloutName":"-","FilterName":"File and Printer Sharing (Spooler Service - RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{13781486-B4E7-4915-ACED-17E212CF5CBF}\n\tName:\t\tRPC Endpoint Mapper (TCP, Incoming)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829108\n\nLayer Information:\n\tID:\t\t{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}\n\tName:\t\tALE Listen v6 Layer\n\tRun-Time ID:\t42\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293541528731616\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.176Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"0754250bef4431347defe0798de4cf287588137866bd56c1c4836c04f991bce7","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328337,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"42","Weight":"10376293541528731616","FilterKey":"{13781486-B4E7-4915-ACED-17E212CF5CBF}","Action":"%%16390","FilterId":"829108","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251","FilterType":"%%16388","ProviderName":"Microsoft Corporation","LayerKey":"{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}","UserSid":"S-1-5-19","LayerName":"ALE Listen v6 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ChangeType":"%%16385","CalloutName":"-","FilterName":"RPC Endpoint Mapper (TCP, Incoming)"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{6F8C6BC7-5969-4DB6-B925-699BCE7C6017}\n\tName:\t\tMicrosoft Key Distribution Service\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829115\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376540038224674816\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.176Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"37607685e6a7fabcfb64082d8ea8f72f72285f3ea4c97e328f3166764891e93d","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328344,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"46","FilterKey":"{6F8C6BC7-5969-4DB6-B925-699BCE7C6017}","Weight":"10376540038224674816","Action":"%%16390","FilterId":"829115","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","ProviderName":"Microsoft Corporation","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","UserSid":"S-1-5-19","CalloutKey":"{00000000-0000-0000-0000-000000000000}","LayerName":"ALE Receive/Accept v6 Layer","ChangeType":"%%16385","CalloutName":"-","FilterName":"Microsoft Key Distribution Service"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{11004711-22BA-41EF-ACF8-B96335671B69}\n\tName:\t\tDFS Replication (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829122\n\nLayer Information:\n\tID:\t\t{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}\n\tName:\t\tALE Listen v6 Layer\n\tRun-Time ID:\t42\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293541528731616\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.177Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"47ef81d58b22f80d2c958331d9f677333b83dcce274693f25663e75018fe633f","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328351,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","LayerId":"42","FilterKey":"{11004711-22BA-41EF-ACF8-B96335671B69}","Weight":"10376293541528731616","Action":"%%16390","FilterId":"829122","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerName":"ALE Listen v6 Layer","CalloutKey":"{00000000-0000-0000-0000-000000000000}","UserSid":"S-1-5-19","LayerKey":"{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}","ProviderName":"Microsoft Corporation","CalloutName":"-","ChangeType":"%%16385","FilterName":"DFS Replication (RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{916783F9-45F7-4DB7-829D-53B46EBD41B6}\n\tName:\t\tMicrosoft Key Distribution Service\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829117\n\nLayer Information:\n\tID:\t\t{A3B42C97-9F04-4672-B87E-CEE9C483257F}\n\tName:\t\tALE Receive/Accept v6 Layer\n\tRun-Time ID:\t46\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376540038224674816\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.177Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"78c546ea5a2945f3bd9c13e803e52370deb247429c6e00bd7d24b15b9f0b1928","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328346,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{916783F9-45F7-4DB7-829D-53B46EBD41B6}","LayerId":"46","Weight":"10376540038224674816","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Action":"%%16390","FilterId":"829117","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 6c 00 73 00 61 00-73 00 73 00 2e 00 65 00 \\.l.s.a.s.s...e.\n 00000060 78 00 65 00 00 00 x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tCondition ID:\t{3971ef2b-623e-4f9a-8cb1-6e79b806b9a7}\n\tMatch value:\tEqual to\n\tCondition value:\t0x06","FilterType":"%%16388","LayerKey":"{A3B42C97-9F04-4672-B87E-CEE9C483257F}","ProviderName":"Microsoft Corporation","LayerName":"ALE Receive/Accept v6 Layer","UserSid":"S-1-5-19","CalloutKey":"{00000000-0000-0000-0000-000000000000}","CalloutName":"-","ChangeType":"%%16385","FilterName":"Microsoft Key Distribution Service"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{06460832-16E2-442E-BE22-523E9759C9AE}\n\tName:\t\tDFS Replication (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829124\n\nLayer Information:\n\tID:\t\t{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}\n\tName:\t\tALE Listen v6 Layer\n\tRun-Time ID:\t42\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293541528731616\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:41:35.177Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"015e190d7961a6201b11ce58a0ba3316da37b99ee7e47bc62cb102a3bd159f4b","outcome":"success","created":"2025-12-09T03:41:35.324Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328353,"event_id":5447,"process":{"thread":{"id":3360},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","FilterKey":"{06460832-16E2-442E-BE22-523E9759C9AE}","Weight":"10376293541528731616","LayerId":"42","Action":"%%16390","FilterId":"829124","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0251","FilterType":"%%16388","LayerKey":"{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}","CalloutKey":"{00000000-0000-0000-0000-000000000000}","LayerName":"ALE Listen v6 Layer","ProviderName":"Microsoft Corporation","UserSid":"S-1-5-19","ChangeType":"%%16385","CalloutName":"-","FilterName":"DFS Replication (RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.407Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328991,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessId":"0x168","ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.441Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328998,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.425Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328996,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.424Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328994,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x168","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.444Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329001,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.408Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328992,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x168","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.411Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328993,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.442Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329000,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","ProcessId":"0x168","SubjectUserSid":"S-1-5-18","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:17.441Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:47:19.378Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174328999,"event_id":4703,"process":{"thread":{"id":1884},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","ProcessId":"0x168","SubjectUserSid":"S-1-5-18","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has blocked a packet.\n\nApplication Information:\n\tProcess ID:\t\t0\n\tApplication Name:\t-\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t172.30.2.163\n\tSource Port:\t\t1515\n\tDestination Address:\t172.30.4.205\n\tDestination Port:\t\t61731\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t67142\n\tLayer Name:\t\tICMP Error\n\tLayer Run-Time ID:\t28","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:19.752Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Packet Drop","kind":"event","code":5152,"hash":"8e25f60cebc94ec24463f233f315cab45f6d7400d2e0bb5f6a7bee09540cff1d","outcome":"failure","created":"2025-12-09T03:47:21.399Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329002,"event_id":5152,"process":{"thread":{"id":3764},"pid":4},"event_data":{"LayerRTID":"28","ProcessId":"0","SourceAddress":"172.30.2.163","DestAddress":"172.30.4.205","Protocol":"6","DestPort":"61731","Application":"-","Direction":"%%14592","LayerName":"%%14601","FilterRTID":"67142","SourcePort":"1515"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Failure"],"opcode":"Info","task":"Filtering Platform Packet Drop"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-2744872422-3021103393-397187185-1104\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0xEF6EDF8\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:21.413Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Logoff","kind":"event","code":4634,"hash":"80243ed95cd6b42f516013d6e283ca8821c68e06ca8e974332dcb7f26848688f","outcome":"success","created":"2025-12-09T03:47:22.772Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"architecture":"x86_64","hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278536,"event_id":4634,"process":{"thread":{"id":2092},"pid":676},"event_data":{"TargetDomainName":"TDARPLATFORM","TargetLogonId":"0xef6edf8","LogonType":"3","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetUserSid":"S-1-5-21-2744872422-3021103393-397187185-1104"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Logoff"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has blocked a packet.\n\nApplication Information:\n\tProcess ID:\t\t0\n\tApplication Name:\t-\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t172.30.2.163\n\tSource Port:\t\t1515\n\tDestination Address:\t172.30.4.205\n\tDestination Port:\t\t61731\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t67142\n\tLayer Name:\t\tICMP Error\n\tLayer Run-Time ID:\t28","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:25.752Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Packet Drop","kind":"event","code":5152,"hash":"8e25f60cebc94ec24463f233f315cab45f6d7400d2e0bb5f6a7bee09540cff1d","outcome":"failure","created":"2025-12-09T03:47:27.450Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329003,"event_id":5152,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessId":"0","LayerRTID":"28","Application":"-","SourceAddress":"172.30.2.163","Protocol":"6","DestPort":"61731","DestAddress":"172.30.4.205","Direction":"%%14592","LayerName":"%%14601","FilterRTID":"67142","SourcePort":"1515"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Failure"],"opcode":"Info","task":"Filtering Platform Packet Drop"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t2264\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe\n\nNetwork Information:\n\tDirection:\t\tOutbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t61732\n\tDestination Address:\t::1\n\tDestination Port:\t\t389\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t65788\n\tLayer Name:\t\tConnect\n\tLayer Run-Time ID:\t50","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.107Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"49068ce45e9593cf023bd8a9ad63fc52743a1a7c3a8630fded0ca79a31d61c29","outcome":"success","created":"2025-12-09T03:47:28.461Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329005,"event_id":5156,"process":{"thread":{"id":5348},"pid":4},"version":1,"event_data":{"LayerRTID":"50","SourceAddress":"::1","Application":"\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe","RemoteMachineID":"S-1-0-0","DestPort":"389","DestAddress":"::1","ProcessID":"2264","Protocol":"6","Direction":"%%14593","LayerName":"%%14611","RemoteUserID":"S-1-0-0","FilterRTID":"65788","SourcePort":"61732"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a bind to a local port.\n\nApplication Information:\n\tProcess ID:\t\t2264\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe\n\nNetwork Information:\n\tSource Address:\t\t::\n\tSource Port:\t\t61732\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t0\n\tLayer Name:\t\tResource Assignment\n\tLayer Run-Time ID:\t38","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.107Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5158,"hash":"450966819c11cbe60bb8ac8f92afd0bc654bbfee5eb2a28ebefa3e9e4b9d79c5","outcome":"success","created":"2025-12-09T03:47:28.461Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329004,"event_id":5158,"process":{"thread":{"id":5348},"pid":4},"event_data":{"LayerRTID":"38","ProcessId":"2264","LayerName":"%%14608","Application":"\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe","SourceAddress":"::","Protocol":"6","FilterRTID":"0","SourcePort":"61732"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0xDFF1FF0\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.109Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Special Logon","kind":"event","code":4672,"hash":"119eb907bdcf0f7c1971c1eb303ba1c2fb17974df651ad977d3a6db3d2ab9573","outcome":"success","created":"2025-12-09T03:47:28.461Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329007,"event_id":4672,"process":{"thread":{"id":4888},"pid":692},"event_data":{"PrivilegeList":"SeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","SubjectUserSid":"S-1-5-18","SubjectLogonId":"0xdff1ff0","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Special Logon"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t692\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\lsass.exe\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t61732\n\tDestination Address:\t::1\n\tDestination Port:\t\t389\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t65786\n\tLayer Name:\t\tReceive/Accept\n\tLayer Run-Time ID:\t46","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.107Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"f23e67e7fe83a9fcd3fb5bafb9e608e797ce530e4aaba3fc0d4fee767ab47f27","outcome":"success","created":"2025-12-09T03:47:28.461Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329006,"event_id":5156,"process":{"thread":{"id":5348},"pid":4},"version":1,"event_data":{"LayerRTID":"46","Application":"\\device\\harddiskvolume2\\windows\\system32\\lsass.exe","DestAddress":"::1","Protocol":"6","DestPort":"389","RemoteMachineID":"S-1-0-0","ProcessID":"692","SourceAddress":"::1","Direction":"%%14592","LayerName":"%%14610","RemoteUserID":"S-1-0-0","FilterRTID":"65786","SourcePort":"61732"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t3\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM.CSOC\n\tLogon ID:\t\t0xDFF1FF0\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{6A75CB6E-BE25-A65F-629A-5616EAFD4D81}\n\nProcess Information:\n\tProcess ID:\t\t0x0\n\tProcess Name:\t\t-\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t::1\n\tSource Port:\t\t61732\n\nDetailed Authentication Information:\n\tLogon Process:\t\tKerberos\n\tAuthentication Package:\tKerberos\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.109Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Logon","kind":"event","code":4624,"hash":"ac1516fbba519fe15d158bc33cca59af8be0e3e1de17e63921c34601e6e34179","outcome":"success","created":"2025-12-09T03:47:28.461Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329008,"event_id":4624,"process":{"thread":{"id":4888},"pid":692},"version":2,"event_data":{"VirtualAccount":"%%1843","TargetUserName":"WIN-MDLQ2GQ94V9$","LogonProcessName":"Kerberos","SubjectDomainName":"-","IpAddress":"::1","SubjectUserName":"-","TargetOutboundUserName":"-","LogonGuid":"{6A75CB6E-BE25-A65F-629A-5616EAFD4D81}","ImpersonationLevel":"%%1833","TargetLogonId":"0xdff1ff0","SubjectLogonId":"0x0","IpPort":"61732","TargetUserSid":"S-1-5-18","LmPackageName":"-","ProcessId":"0x0","SubjectUserSid":"S-1-0-0","ProcessName":"-","TargetOutboundDomainName":"-","KeyLength":"0","TargetDomainName":"TDARPLATFORM.CSOC","LogonType":"3","TargetLinkedLogonId":"0x0","AuthenticationPackageName":"Kerberos","TransmittedServices":"-","RestrictedAdminMode":"-","WorkstationName":"-","ElevatedToken":"%%1842"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Logon"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0xDFF1FF0\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.110Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Logoff","kind":"event","code":4634,"hash":"a104c810667fca335ba943c8980a29cad1c7a9ac82d8ed8f881865ca1bc40a53","outcome":"success","created":"2025-12-09T03:47:28.461Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329010,"event_id":4634,"process":{"thread":{"id":3360},"pid":692},"event_data":{"LogonType":"3","TargetDomainName":"TDARPLATFORM","TargetLogonId":"0xdff1ff0","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetUserSid":"S-1-5-18"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Logoff"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.053Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"architecture":"x86_64","hostname":"w2016ad-n25","mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278537,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.068Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"id":"9ca2332f-614b-4da2-897e-35dfbc072591","architecture":"x86_64","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"name":"w2016ad-n25.tdarplatform.csoc","hostname":"w2016ad-n25","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278541,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"w2016ad-n25","ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.069Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278542,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.070Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"architecture":"x86_64","hostname":"w2016ad-n25","mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278543,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessId":"0x11c","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"w2016ad-n25","ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.054Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"id":"9ca2332f-614b-4da2-897e-35dfbc072591","architecture":"x86_64","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"name":"w2016ad-n25.tdarplatform.csoc","hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278538,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.080Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","hostname":"w2016ad-n25","mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278545,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","ProcessId":"0x11c","SubjectUserSid":"S-1-5-18","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.080Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"hostname":"w2016ad-n25","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278544,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.068Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278540,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.082Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"id":"9ca2332f-614b-4da2-897e-35dfbc072591","architecture":"x86_64","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"name":"w2016ad-n25.tdarplatform.csoc","hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278547,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessId":"0x11c","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.057Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278539,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x11c","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tW2016AD-N25$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x11c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:47:27.081Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"e770a27583b7f245cff6759ed7690348fdc7636bb468382cd14998ab7a97e611","outcome":"success","created":"2025-12-09T03:47:28.825Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"hostname":"w2016ad-n25","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278546,"event_id":4703,"process":{"thread":{"id":212},"pid":4},"event_data":{"ProcessId":"0x11c","ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","TargetUserName":"W2016AD-N25$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"W2016AD-N25$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a bind to a local port.\n\nApplication Information:\n\tProcess ID:\t\t2264\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe\n\nNetwork Information:\n\tSource Address:\t\t::\n\tSource Port:\t\t61742\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t0\n\tLayer Name:\t\tResource Assignment\n\tLayer Run-Time ID:\t38","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:27.113Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5158,"hash":"9aec6ce822bc1e5ed4387faf35c8183b7b76e33bd66eaf891b2c9ddee8545ca0","outcome":"success","created":"2025-12-09T03:48:28.995Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329144,"event_id":5158,"process":{"thread":{"id":2628},"pid":4},"event_data":{"ProcessId":"2264","LayerRTID":"38","LayerName":"%%14608","Application":"\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe","SourceAddress":"::","Protocol":"6","FilterRTID":"0","SourcePort":"61742"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t692\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\lsass.exe\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t61742\n\tDestination Address:\t::1\n\tDestination Port:\t\t389\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t65786\n\tLayer Name:\t\tReceive/Accept\n\tLayer Run-Time ID:\t46","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:27.113Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"e8ffeb97c10470ac96028ce04f9764c35e4064dd12abdd5e9e559bb2b1018844","outcome":"success","created":"2025-12-09T03:48:28.995Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329146,"event_id":5156,"process":{"thread":{"id":2628},"pid":4},"version":1,"event_data":{"LayerRTID":"46","Application":"\\device\\harddiskvolume2\\windows\\system32\\lsass.exe","DestAddress":"::1","DestPort":"389","Protocol":"6","RemoteMachineID":"S-1-0-0","ProcessID":"692","SourceAddress":"::1","Direction":"%%14592","LayerName":"%%14610","RemoteUserID":"S-1-0-0","FilterRTID":"65786","SourcePort":"61742"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t2264\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe\n\nNetwork Information:\n\tDirection:\t\tOutbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t61742\n\tDestination Address:\t::1\n\tDestination Port:\t\t389\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t65788\n\tLayer Name:\t\tConnect\n\tLayer Run-Time ID:\t50","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:27.113Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"1b3ecded13b3817b2da4447db87b11cbf731e64731fa0d1cf285bf6a9e2a9c20","outcome":"success","created":"2025-12-09T03:48:28.995Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329145,"event_id":5156,"process":{"thread":{"id":2628},"pid":4},"version":1,"event_data":{"LayerRTID":"50","SourceAddress":"::1","RemoteMachineID":"S-1-0-0","DestPort":"389","Application":"\\device\\harddiskvolume2\\windows\\adws\\microsoft.activedirectory.webservices.exe","DestAddress":"::1","ProcessID":"2264","Protocol":"6","Direction":"%%14593","LayerName":"%%14611","RemoteUserID":"S-1-0-0","FilterRTID":"65788","SourcePort":"61742"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0xDFF3345\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:27.115Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Special Logon","kind":"event","code":4672,"hash":"28b029557588e68a19790b74cfe22e9418a5bbc7043cdc9386f32a81f1683114","outcome":"success","created":"2025-12-09T03:48:28.995Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329147,"event_id":4672,"process":{"thread":{"id":5192},"pid":692},"event_data":{"PrivilegeList":"SeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","SubjectUserSid":"S-1-5-18","SubjectLogonId":"0xdff3345","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Special Logon"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t3\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM.CSOC\n\tLogon ID:\t\t0xDFF3345\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{6A75CB6E-BE25-A65F-629A-5616EAFD4D81}\n\nProcess Information:\n\tProcess ID:\t\t0x0\n\tProcess Name:\t\t-\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t::1\n\tSource Port:\t\t61742\n\nDetailed Authentication Information:\n\tLogon Process:\t\tKerberos\n\tAuthentication Package:\tKerberos\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:27.115Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Logon","kind":"event","code":4624,"hash":"739bd2f00d370efcd2e712364e68bf9454c44dbc81d2cb607edf75886040c698","outcome":"success","created":"2025-12-09T03:48:28.995Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329148,"event_id":4624,"process":{"thread":{"id":5192},"pid":692},"version":2,"event_data":{"VirtualAccount":"%%1843","TargetUserName":"WIN-MDLQ2GQ94V9$","LogonProcessName":"Kerberos","SubjectDomainName":"-","IpAddress":"::1","SubjectUserName":"-","TargetOutboundUserName":"-","LogonGuid":"{6A75CB6E-BE25-A65F-629A-5616EAFD4D81}","ImpersonationLevel":"%%1833","TargetLogonId":"0xdff3345","SubjectLogonId":"0x0","IpPort":"61742","TargetUserSid":"S-1-5-18","TargetOutboundDomainName":"-","ProcessName":"-","SubjectUserSid":"S-1-0-0","LmPackageName":"-","ProcessId":"0x0","KeyLength":"0","TargetDomainName":"TDARPLATFORM.CSOC","TargetLinkedLogonId":"0x0","LogonType":"3","AuthenticationPackageName":"Kerberos","TransmittedServices":"-","RestrictedAdminMode":"-","WorkstationName":"-","ElevatedToken":"%%1842"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Logon"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0xDFF3345\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:27.116Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Logoff","kind":"event","code":4634,"hash":"e0098747990d861d5c9a16cfc7d8e4c7e3f509804020eb055de0aa8eb0c06dba","outcome":"success","created":"2025-12-09T03:48:28.995Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329150,"event_id":4634,"process":{"thread":{"id":4260},"pid":692},"event_data":{"LogonType":"3","TargetDomainName":"TDARPLATFORM","TargetLogonId":"0xdff3345","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetUserSid":"S-1-5-18"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Logoff"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has blocked a packet.\n\nApplication Information:\n\tProcess ID:\t\t0\n\tApplication Name:\t-\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t172.30.2.163\n\tSource Port:\t\t1514\n\tDestination Address:\t172.30.4.205\n\tDestination Port:\t\t61741\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t67142\n\tLayer Name:\t\tICMP Error\n\tLayer Run-Time ID:\t28","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:27.823Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Packet Drop","kind":"event","code":5152,"hash":"f2bd0e649bc78edae47ef3af1348cc65fcc34408e055a8c8e9773564db846e96","outcome":"failure","created":"2025-12-09T03:48:28.995Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329151,"event_id":5152,"process":{"thread":{"id":5492},"pid":4},"event_data":{"ProcessId":"0","LayerRTID":"28","SourceAddress":"172.30.2.163","DestAddress":"172.30.4.205","DestPort":"61741","Protocol":"6","Application":"-","Direction":"%%14592","LayerName":"%%14601","FilterRTID":"67142","SourcePort":"1514"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Failure"],"opcode":"Info","task":"Filtering Platform Packet Drop"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t2512\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\dns.exe\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t50520\n\tDestination Address:\t::1\n\tDestination Port:\t\t53\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t65786\n\tLayer Name:\t\tReceive/Accept\n\tLayer Run-Time ID:\t46","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.046Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"642e53af96f469628fd6a27f6fcc44f988807d5ea479008ab9c02c7349d1c05f","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329155,"event_id":5156,"process":{"thread":{"id":3764},"pid":4},"version":1,"event_data":{"LayerRTID":"46","Application":"\\device\\harddiskvolume2\\windows\\system32\\dns.exe","RemoteMachineID":"S-1-0-0","DestPort":"53","Protocol":"17","SourceAddress":"::1","ProcessID":"2512","DestAddress":"::1","Direction":"%%14592","LayerName":"%%14610","RemoteUserID":"S-1-0-0","FilterRTID":"65786","SourcePort":"50520"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a bind to a local port.\n\nApplication Information:\n\tProcess ID:\t\t1200\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\svchost.exe\n\nNetwork Information:\n\tSource Address:\t\t::\n\tSource Port:\t\t60891\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t0\n\tLayer Name:\t\tResource Assignment\n\tLayer Run-Time ID:\t36","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.047Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5158,"hash":"ffdc335cfea70f1480c7150f34d78685170e287ba9adc91044198a3b35ccb17a","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329156,"event_id":5158,"process":{"thread":{"id":3764},"pid":4},"event_data":{"LayerRTID":"36","ProcessId":"1200","LayerName":"%%14608","Application":"\\device\\harddiskvolume2\\windows\\system32\\svchost.exe","SourceAddress":"::","Protocol":"17","FilterRTID":"0","SourcePort":"60891"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a bind to a local port.\n\nApplication Information:\n\tProcess ID:\t\t1200\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\svchost.exe\n\nNetwork Information:\n\tSource Address:\t\t::\n\tSource Port:\t\t60891\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t0\n\tLayer Name:\t\tResource Assignment\n\tLayer Run-Time ID:\t38","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.047Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5158,"hash":"eb98e2b2c3d0cd8e10325595113a7da48c59886c9f9fb615fd4fc5dc11a4b745","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329157,"event_id":5158,"process":{"thread":{"id":3764},"pid":4},"event_data":{"LayerRTID":"38","ProcessId":"1200","LayerName":"%%14608","Application":"\\device\\harddiskvolume2\\windows\\system32\\svchost.exe","SourceAddress":"::","Protocol":"17","FilterRTID":"0","SourcePort":"60891"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t1200\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\svchost.exe\n\nNetwork Information:\n\tDirection:\t\tOutbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t60891\n\tDestination Address:\t::1\n\tDestination Port:\t\t53\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t65788\n\tLayer Name:\t\tConnect\n\tLayer Run-Time ID:\t50","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.047Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"1653d64b5ae488dd3ab86cfc86afdb1d6fd5533e9ed3a39210d9451470f40080","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329158,"event_id":5156,"process":{"thread":{"id":3764},"pid":4},"version":1,"event_data":{"LayerRTID":"50","SourceAddress":"::1","RemoteMachineID":"S-1-0-0","DestPort":"53","Application":"\\device\\harddiskvolume2\\windows\\system32\\svchost.exe","DestAddress":"::1","ProcessID":"1200","Protocol":"17","Direction":"%%14593","LayerName":"%%14611","RemoteUserID":"S-1-0-0","FilterRTID":"65788","SourcePort":"60891"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t1200\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\svchost.exe\n\nNetwork Information:\n\tDirection:\t\tOutbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t50520\n\tDestination Address:\t::1\n\tDestination Port:\t\t53\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t65788\n\tLayer Name:\t\tConnect\n\tLayer Run-Time ID:\t50","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.046Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"d03598659d2440f30f1e5a5de4d062da7e13930dac6337a62f470bbf76bc2fdf","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329154,"event_id":5156,"process":{"thread":{"id":3764},"pid":4},"version":1,"event_data":{"LayerRTID":"50","Application":"\\device\\harddiskvolume2\\windows\\system32\\svchost.exe","DestAddress":"::1","SourceAddress":"::1","DestPort":"53","Protocol":"17","ProcessID":"1200","RemoteMachineID":"S-1-0-0","Direction":"%%14593","LayerName":"%%14611","RemoteUserID":"S-1-0-0","FilterRTID":"65788","SourcePort":"50520"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a bind to a local port.\n\nApplication Information:\n\tProcess ID:\t\t1200\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\svchost.exe\n\nNetwork Information:\n\tSource Address:\t\t::\n\tSource Port:\t\t50520\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t0\n\tLayer Name:\t\tResource Assignment\n\tLayer Run-Time ID:\t38","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.046Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5158,"hash":"a1009b5a336caa98c7aaa8dc1bf45f9b137beb92ce044f8f908c6e62e46b616b","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329153,"event_id":5158,"process":{"thread":{"id":3764},"pid":4},"event_data":{"LayerRTID":"38","ProcessId":"1200","LayerName":"%%14608","Application":"\\device\\harddiskvolume2\\windows\\system32\\svchost.exe","SourceAddress":"::","Protocol":"17","FilterRTID":"0","SourcePort":"50520"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t2512\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\dns.exe\n\nNetwork Information:\n\tDirection:\t\tOutbound\n\tSource Address:\t\t172.30.4.205\n\tSource Port:\t\t64226\n\tDestination Address:\t172.30.4.254\n\tDestination Port:\t\t53\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t67157\n\tLayer Name:\t\tConnect\n\tLayer Run-Time ID:\t48","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.047Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"34fcb90de58d77a42f4ba5a4b02737e9d253245a9aeca0f01e4564054a9e8c84","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329160,"event_id":5156,"process":{"thread":{"id":3764},"pid":4},"version":1,"event_data":{"LayerRTID":"48","Application":"\\device\\harddiskvolume2\\windows\\system32\\dns.exe","DestAddress":"172.30.4.254","Protocol":"17","DestPort":"53","RemoteMachineID":"S-1-0-0","ProcessID":"2512","SourceAddress":"172.30.4.205","Direction":"%%14593","LayerName":"%%14611","RemoteUserID":"S-1-0-0","FilterRTID":"67157","SourcePort":"64226"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a bind to a local port.\n\nApplication Information:\n\tProcess ID:\t\t1200\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\svchost.exe\n\nNetwork Information:\n\tSource Address:\t\t::\n\tSource Port:\t\t50520\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t0\n\tLayer Name:\t\tResource Assignment\n\tLayer Run-Time ID:\t36","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.046Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5158,"hash":"d8ff7289cdae747b4b7cd7ede89e31e4da2ce8e9fd1d6f544893343da6d37ffe","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329152,"event_id":5158,"process":{"thread":{"id":3764},"pid":4},"event_data":{"LayerRTID":"36","ProcessId":"1200","LayerName":"%%14608","Application":"\\device\\harddiskvolume2\\windows\\system32\\svchost.exe","SourceAddress":"::","Protocol":"17","FilterRTID":"0","SourcePort":"50520"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has permitted a connection.\n\nApplication Information:\n\tProcess ID:\t\t2512\n\tApplication Name:\t\\device\\harddiskvolume2\\windows\\system32\\dns.exe\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t::1\n\tSource Port:\t\t60891\n\tDestination Address:\t::1\n\tDestination Port:\t\t53\n\tProtocol:\t\t17\n\nFilter Information:\n\tFilter Run-Time ID:\t65786\n\tLayer Name:\t\tReceive/Accept\n\tLayer Run-Time ID:\t46","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:29.047Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Connection","kind":"event","code":5156,"hash":"76a161718f0f463075981e6db463f3ef10522c02664cf83e1f4893c1bd69b924","outcome":"success","created":"2025-12-09T03:48:31.013Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329159,"event_id":5156,"process":{"thread":{"id":3764},"pid":4},"version":1,"event_data":{"LayerRTID":"46","SourceAddress":"::1","DestAddress":"::1","DestPort":"53","Protocol":"17","RemoteMachineID":"S-1-0-0","ProcessID":"2512","Application":"\\device\\harddiskvolume2\\windows\\system32\\dns.exe","Direction":"%%14592","LayerName":"%%14610","RemoteUserID":"S-1-0-0","FilterRTID":"65786","SourcePort":"60891"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Filtering Platform Connection"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has blocked a packet.\n\nApplication Information:\n\tProcess ID:\t\t0\n\tApplication Name:\t-\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t172.30.2.163\n\tSource Port:\t\t1514\n\tDestination Address:\t172.30.4.206\n\tDestination Port:\t\t59778\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t67042\n\tLayer Name:\t\tICMP Error\n\tLayer Run-Time ID:\t28","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:33.280Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Packet Drop","kind":"event","code":5152,"hash":"e3e15592adf71c95915ed59a980377bf78faa7313792cd8a1c1ad0dfa958232d","outcome":"failure","created":"2025-12-09T03:48:34.372Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","architecture":"x86_64","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"hostname":"w2016ad-n25","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278730,"event_id":5152,"process":{"thread":{"id":2824},"pid":4},"event_data":{"LayerRTID":"28","ProcessId":"0","Application":"-","DestAddress":"172.30.4.206","Protocol":"6","SourceAddress":"172.30.2.163","DestPort":"59778","Direction":"%%14592","LayerName":"%%14601","FilterRTID":"67042","SourcePort":"1514"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Failure"],"opcode":"Info","task":"Filtering Platform Packet Drop"},"agent":{"id":"16b27c50-d19b-4829-8363-ff3aabf1f846","name":"w2016ad-n25","ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.460Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329165,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.442Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329161,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.473Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329168,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessId":"0x168","ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.460Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329166,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","ProcessId":"0x168","SubjectUserSid":"S-1-5-18","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.443Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329162,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","ProcessId":"0x168","SubjectUserSid":"S-1-5-18","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.473Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329169,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.447Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329163,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessId":"0x168","ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.473Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.084Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329170,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x168","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.462Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"architecture":"x86_64","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329167,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x168","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.460Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.083Z"},"event_type":"windows","host":{"id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","architecture":"x86_64","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","hostname":"WIN-MDLQ2GQ94V9","os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329164,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessId":"0x168","SubjectUserSid":"S-1-5-18","ProcessName":"C:\\Windows\\System32\\svchost.exe","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A token right was adjusted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nTarget Account:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\tWIN-MDLQ2GQ94V9$\n\tAccount Domain:\t\tTDARPLATFORM\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t0x168\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nEnabled Privileges:\n\t\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege\n\nDisabled Privileges:\n\t\t\t-","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:37.475Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Token Right Adjusted Events","kind":"event","code":4703,"hash":"9f10e46b504715c3bde6597262aff1c5993c26c344a6170f7f587a0d665def84","outcome":"success","created":"2025-12-09T03:48:39.084Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"},"mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329171,"event_id":4703,"process":{"thread":{"id":3764},"pid":4},"event_data":{"ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectUserSid":"S-1-5-18","ProcessId":"0x168","TargetUserName":"WIN-MDLQ2GQ94V9$","TargetDomainName":"TDARPLATFORM","SubjectDomainName":"TDARPLATFORM","SubjectUserName":"WIN-MDLQ2GQ94V9$","DisabledPrivilegeList":"-","TargetLogonId":"0x3e7","SubjectLogonId":"0x3e7","EnabledPrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeIncreaseQuotaPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeSystemtimePrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeShutdownPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeUndockPrivilege\n\t\t\tSeManageVolumePrivilege","TargetUserSid":"S-1-0-0"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","keywords":["Audit Success"],"opcode":"Info","task":"Token Right Adjusted Events"},"agent":{"id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"The Windows Filtering Platform has blocked a packet.\n\nApplication Information:\n\tProcess ID:\t\t0\n\tApplication Name:\t-\n\nNetwork Information:\n\tDirection:\t\tInbound\n\tSource Address:\t\t172.30.2.163\n\tSource Port:\t\t1514\n\tDestination Address:\t172.30.4.206\n\tDestination Port:\t\t59778\n\tProtocol:\t\t6\n\nFilter Information:\n\tFilter Run-Time ID:\t67042\n\tLayer Name:\t\tICMP Error\n\tLayer Run-Time ID:\t28","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:39.300Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Filtering Platform Packet Drop","kind":"event","code":5152,"hash":"e3e15592adf71c95915ed59a980377bf78faa7313792cd8a1c1ad0dfa958232d","outcome":"failure","created":"2025-12-09T03:48:40.413Z"},"event_type":"windows","host":{"name":"w2016ad-n25.tdarplatform.csoc","id":"9ca2332f-614b-4da2-897e-35dfbc072591","ip":["fe80::cd46:3442:b9b4:26f4","172.30.4.206","fe80::5efe:ac1e:4ce","2001:0:2851:782c:c01:960:5498:fa31","fe80::c01:960:5498:fa31"],"architecture":"x86_64","hostname":"w2016ad-n25","os":{"name":"Windows Server 2016 Standard","platform":"windows","build":"14393.2430","version":"10.0","family":"windows","kernel":"10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810)"},"mac":["00:50:56:bf:9f:79","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"]},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":225278731,"event_id":5152,"process":{"thread":{"id":4908},"pid":4},"event_data":{"LayerRTID":"28","ProcessId":"0","Application":"-","SourceAddress":"172.30.2.163","DestPort":"59778","DestAddress":"172.30.4.206","Protocol":"6","Direction":"%%14592","LayerName":"%%14601","FilterRTID":"67042","SourcePort":"1514"},"channel":"Security","api":"wineventlog","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"w2016ad-n25.tdarplatform.csoc","keywords":["Audit Failure"],"opcode":"Info","task":"Filtering Platform Packet Drop"},"agent":{"name":"w2016ad-n25","ephemeral_id":"1530b4ef-9f46-47ac-878f-b9641a8c1f13","id":"16b27c50-d19b-4829-8363-ff3aabf1f846","hostname":"w2016ad-n25","version":"7.10.2","type":"winlogbeat"}}
{"tags":["beats_input_codec_plain_applied"],"message":"A Windows Filtering Platform filter has been changed.\n\t\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tNT AUTHORITY\\LOCAL SERVICE\n\nProcess Information:\n\tProcess ID:\t1412\n\nProvider Information:\n\tID:\t\t{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}\n\tName:\t\tMicrosoft Corporation\n\nChange Information:\n\tChange Type:\tDelete\n\nFilter Information:\n\tID:\t\t{6839AC0F-3AB1-416F-94B1-CE324B973723}\n\tName:\t\tActive Directory Domain Controller (RPC-EPMAP)\n\tType:\t\tNot persistent\n\tRun-Time ID:\t829242\n\nLayer Information:\n\tID:\t\t{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}\n\tName:\t\tALE Listen v6 Layer\n\tRun-Time ID:\t42\n\nCallout Information:\n\tID:\t\t{00000000-0000-0000-0000-000000000000}\n\tName:\t\t-\n\nAdditional Information:\n\tWeight:\t10376293541528731616\t\n\tConditions:\t\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087\n\n\tFilter Action:\tPermit","type":"winlogbeat","@version":"1","ecs":{"version":"1.5.0"},"@timestamp":"2025-12-09T03:48:43.252Z","event":{"provider":"Microsoft-Windows-Security-Auditing","action":"Other Policy Change Events","kind":"event","code":5447,"hash":"94ff6b5d4f377dc071ef7d6e5f8fae5a4a4bed9c8669e21da8d4f980684431ca","outcome":"success","created":"2025-12-09T03:48:45.149Z"},"event_type":"windows","host":{"name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","architecture":"x86_64","id":"d3fe0a29-15df-481b-ab7d-fd4eb311fbc5","ip":["fe80::6c1c:1afd:b16:ecb9","172.30.4.205","fe80::5efe:ac1e:4cd","2001:0:2851:782c:8fa:3638:53e1:fb32","fe80::8fa:3638:53e1:fb32"],"hostname":"WIN-MDLQ2GQ94V9","mac":["00:50:56:bf:cb:a8","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"platform":"windows","name":"Windows Server 2016 Standard","build":"14393.5717","version":"10.0","family":"windows","kernel":"10.0.14393.5717 (rs1_release.230203-1742)"}},"log":{"level":"information"},"winlog":{"provider_name":"Microsoft-Windows-Security-Auditing","record_id":174329274,"event_id":5447,"process":{"thread":{"id":4260},"pid":692},"event_data":{"ProcessId":"1412","UserName":"NT AUTHORITY\\LOCAL SERVICE","FilterKey":"{6839AC0F-3AB1-416F-94B1-CE324B973723}","LayerId":"42","ProviderKey":"{DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62}","Weight":"10376293541528731616","Action":"%%16390","FilterId":"829242","Conditions":"\n\tCondition ID:\t{d78e1e87-8644-4ea5-9437-d809ecefc971}\n\tMatch value:\tEqual to\n\tCondition value:\t\n 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \\.d.e.v.i.c.e.\\.\n 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k.\n 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.\\.\n 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.\\.\n 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2.\n 00000050 5c 00 73 00 76 00 63 00-68 00 6f 00 73 00 74 00 \\.s.v.c.h.o.s.t.\n 00000060 2e 00 65 00 78 00 65 00-00 00 ..e.x.e...\n\n\n\tCondition ID:\t{af043a0a-b34d-4f86-979c-c90371af6e66}\n\tMatch value:\tEqual to\n\tCondition value:\t\nO:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080)\n\n\n\tCondition ID:\t{0c1ba1af-5765-453f-af22-a8f791ac775b}\n\tMatch value:\tEqual to\n\tCondition value:\t0x0087","FilterType":"%%16388","LayerKey":"{7AC9DE24-17DD-4814-B4BD-A9FBC95A321B}","LayerName":"ALE Listen v6 Layer","UserSid":"S-1-5-19","ProviderName":"Microsoft Corporation","CalloutKey":"{00000000-0000-0000-0000-000000000000}","ChangeType":"%%16385","CalloutName":"-","FilterName":"Active Directory Domain Controller (RPC-EPMAP)"},"api":"wineventlog","channel":"Security","provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name":"WIN-MDLQ2GQ94V9.tdarplatform.csoc","activity_id":"{49374407-4D0A-0003-0E44-37490A4DDC01}","keywords":["Audit Success"],"opcode":"Info","task":"Other Policy Change Events"},"agent":{"ephemeral_id":"49ee14d1-7c86-449b-9321-e909c76b3d64","id":"829caaa0-db4b-40b2-8076-11ac1493a97b","name":"WIN-MDLQ2GQ94V9","hostname":"WIN-MDLQ2GQ94V9","version":"7.10.2","type":"winlogbeat"}}