Data Source: Windows Event Log Security 4798

Logs an enumeration of local group membership on a system, including details about the groups queried and the account performing the action.

Property Value
Source XmlWinEventLog:Security
Sourcetype xmlwineventlog
Separator EventCode
+ Fields

            1
            _time
          
            3
            ActivityID
          
            5
            CallerProcessId
          
            7
            CallerProcessName
          
            9
            Caller_Domain
          
            11
            Caller_User_Name
          
            13
            Channel
          
            15
            Computer
          
            17
            Error_Code
          
            19
            EventCode
          
            21
            EventData_Xml
          
            23
            EventID
          
            25
            EventRecordID
          
            27
            Guid
          
            29
            Keywords
          
            31
            Level
          
            33
            Logon_ID
          
            35
            Name
          
            37
            Opcode
          
            39
            ProcessID
          
            41
            RecordNumber
          
            43
            SubjectDomainName
          
            45
            SubjectLogonId
          
            47
            SubjectUserName
          
            49
            SubjectUserSid
          
            51
            SystemTime
          
            53
            System_Props_Xml
          
            55
            TargetDomainName
          
            57
            TargetSid
          
            59
            TargetUserName
          
            61
            Target_Domain
          
            63
            Target_User_Name
          
            65
            Task
          
            67
            ThreadID
          
            69
            Version
          
            71
            action
          
            73
            app
          
            75
            date_hour
          
            77
            date_mday
          
            79
            date_minute
          
            81
            date_month
          
            83
            date_second
          
            85
            date_wday
          
            87
            date_year
          
            89
            date_zone
          
            91
            dest
          
            93
            dest_nt_domain
          
            95
            dvc
          
            97
            dvc_nt_host
          
            99
            event_id
          
            101
            eventtype
          
            103
            host
          
            105
            id
          
            107
            index
          
            109
            linecount
          
            111
            product
          
            113
            punct
          
            115
            session_id
          
            117
            signature_id
          
            119
            source
          
            121
            sourcetype
          
            123
            splunk_server
          
            125
            src_nt_domain
          
            127
            src_user
          
            129
            status
          
            131
            ta_windows_action
          
            133
            tag
          
            135
            tag::action
          
            137
            tag::eventtype
          
            139
            timeendpos
          
            141
            timestartpos
          
            143
            user
          
            145
            user_group
          
            147
            vendor
          
            149
            vendor_product
          
            151
            
          
...
not set
1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4798</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-02-02T00:12:21.404799400Z'/><EventRecordID>386860</EventRecordID><Correlation ActivityID='{A0011278-554F-0000-8212-01A04F55DA01}'/><Execution ProcessID='584' ThreadID='5616'/><Channel>Security</Channel><Computer>ar-win-2.attackrange.local</Computer><Security/></System><EventData><Data Name='TargetUserName'>Guest</Data><Data Name='TargetDomainName'>AR-WIN-2</Data><Data Name='TargetSid'>AR-WIN-2\Guest</Data><Data Name='SubjectUserSid'>AR-WIN-2\Administrator</Data><Data Name='SubjectUserName'>Administrator</Data><Data Name='SubjectDomainName'>AR-WIN-2</Data><Data Name='SubjectLogonId'>0x2f4df4</Data><Data Name='CallerProcessId'>0x1590</Data><Data Name='CallerProcessName'>C:\Windows\ImmersiveControlPanel\telegram\telegram.exe</Data></EventData></Event>
zed

Source: GitHub | Version: 2