forked from elastic/beats
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Winlogbeat] Add support for eventID 4688 & 4689 (elastic#14557)
* [Winlogbeat] Add support for eventID 4688 & 4689 - add support for 4688 (Process created) - add support for 4689 (Process exited) - Added event.category & event.type like sysmon module Fixes elastic#14038
- Loading branch information
Showing
8 changed files
with
310 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file added
BIN
+68 KB
...k/winlogbeat/module/security/test/testdata/security-windows2019_4688_Process_Created.evtx
Binary file not shown.
73 changes: 73 additions & 0 deletions
73
.../module/security/test/testdata/security-windows2019_4688_Process_Created.evtx.golden.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| [ | ||
| { | ||
| "@timestamp": "2019-11-14T17:10:15.1515514Z", | ||
| "event": { | ||
| "action": "created-process", | ||
| "category": "process", | ||
| "code": 4688, | ||
| "kind": "event", | ||
| "module": "security", | ||
| "provider": "Microsoft-Windows-Security-Auditing", | ||
| "type": "process_start" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-21-1610636575-2290000098-1654242922-1000\n\tAccount Name:\t\tvagrant\n\tAccount Domain:\t\tVAGRANT\n\tLogon ID:\t\t0x274A2\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x11cc\n\tNew Process Name:\tC:\\Windows\\System32\\wevtutil.exe\n\tToken Elevation Type:\t%%1937\n\tMandatory Label:\t\tS-1-16-12288\n\tCreator Process ID:\t0x122c\n\tCreator Process Name:\tC:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\n\tProcess Command Line:\t\"C:\\Windows\\system32\\wevtutil.exe\" cl Security\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.", | ||
| "process": { | ||
| "args": [ | ||
| "C:\\Windows\\system32\\wevtutil.exe", | ||
| "cl", | ||
| "Security" | ||
| ], | ||
| "command_line": "\"C:\\Windows\\system32\\wevtutil.exe\" cl Security", | ||
| "executable": "C:\\Windows\\System32\\wevtutil.exe", | ||
| "name": "wevtutil.exe", | ||
| "parent": { | ||
| "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", | ||
| "name": "powershell.exe" | ||
| }, | ||
| "pid": 4556 | ||
| }, | ||
| "user": { | ||
| "domain": "VAGRANT", | ||
| "id": "S-1-5-21-1610636575-2290000098-1654242922-1000", | ||
| "name": "vagrant" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "vagrant", | ||
| "event_data": { | ||
| "CommandLine": "\"C:\\Windows\\system32\\wevtutil.exe\" cl Security", | ||
| "MandatoryLabel": "S-1-16-12288", | ||
| "ProcessId": "0x122c", | ||
| "SubjectDomainName": "VAGRANT", | ||
| "SubjectLogonId": "0x274a2", | ||
| "SubjectUserName": "vagrant", | ||
| "SubjectUserSid": "S-1-5-21-1610636575-2290000098-1654242922-1000", | ||
| "TargetDomainName": "-", | ||
| "TargetLogonId": "0x0", | ||
| "TargetUserName": "-", | ||
| "TargetUserSid": "S-1-0-0", | ||
| "TokenElevationType": "%%1937" | ||
| }, | ||
| "event_id": 4688, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 4, | ||
| "thread": { | ||
| "id": 5076 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 5010, | ||
| "task": "Process Creation", | ||
| "version": 2 | ||
| } | ||
| } | ||
| ] |
Binary file added
BIN
+68 KB
...ck/winlogbeat/module/security/test/testdata/security-windows2019_4689_Process_Exited.evtx
Binary file not shown.
161 changes: 161 additions & 0 deletions
161
...t/module/security/test/testdata/security-windows2019_4689_Process_Exited.evtx.golden.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,161 @@ | ||
| [ | ||
| { | ||
| "@timestamp": "2019-11-14T21:26:49.4961966Z", | ||
| "event": { | ||
| "action": "exited-process", | ||
| "category": "process", | ||
| "code": 4689, | ||
| "kind": "event", | ||
| "module": "security", | ||
| "provider": "Microsoft-Windows-Security-Auditing", | ||
| "type": "process_end" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "A process has exited.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1610636575-2290000098-1654242922-1000\n\tAccount Name:\t\tvagrant\n\tAccount Domain:\t\tVAGRANT\n\tLogon ID:\t\t0x274A2\n\nProcess Information:\n\tProcess ID:\t0x1524\n\tProcess Name:\tC:\\Windows\\System32\\wevtutil.exe\n\tExit Status:\t0x0", | ||
| "process": { | ||
| "executable": "C:\\Windows\\System32\\wevtutil.exe", | ||
| "name": "wevtutil.exe", | ||
| "pid": 5412 | ||
| }, | ||
| "user": { | ||
| "domain": "VAGRANT", | ||
| "id": "S-1-5-21-1610636575-2290000098-1654242922-1000", | ||
| "name": "vagrant" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "vagrant", | ||
| "event_data": { | ||
| "Status": "0x0", | ||
| "SubjectDomainName": "VAGRANT", | ||
| "SubjectLogonId": "0x274a2", | ||
| "SubjectUserName": "vagrant", | ||
| "SubjectUserSid": "S-1-5-21-1610636575-2290000098-1654242922-1000" | ||
| }, | ||
| "event_id": 4689, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 4, | ||
| "thread": { | ||
| "id": 1168 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 7538, | ||
| "task": "Process Termination" | ||
| } | ||
| }, | ||
| { | ||
| "@timestamp": "2019-11-14T21:27:46.9609089Z", | ||
| "event": { | ||
| "action": "exited-process", | ||
| "category": "process", | ||
| "code": 4689, | ||
| "kind": "event", | ||
| "module": "security", | ||
| "provider": "Microsoft-Windows-Security-Auditing", | ||
| "type": "process_end" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "A process has exited.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1610636575-2290000098-1654242922-1000\n\tAccount Name:\t\tvagrant\n\tAccount Domain:\t\tVAGRANT\n\tLogon ID:\t\t0x274F1\n\nProcess Information:\n\tProcess ID:\t0xf94\n\tProcess Name:\tC:\\Windows\\System32\\taskhostw.exe\n\tExit Status:\t0x0", | ||
| "process": { | ||
| "executable": "C:\\Windows\\System32\\taskhostw.exe", | ||
| "name": "taskhostw.exe", | ||
| "pid": 3988 | ||
| }, | ||
| "user": { | ||
| "domain": "VAGRANT", | ||
| "id": "S-1-5-21-1610636575-2290000098-1654242922-1000", | ||
| "name": "vagrant" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "vagrant", | ||
| "event_data": { | ||
| "Status": "0x0", | ||
| "SubjectDomainName": "VAGRANT", | ||
| "SubjectLogonId": "0x274f1", | ||
| "SubjectUserName": "vagrant", | ||
| "SubjectUserSid": "S-1-5-21-1610636575-2290000098-1654242922-1000" | ||
| }, | ||
| "event_id": 4689, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 4, | ||
| "thread": { | ||
| "id": 500 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 7542, | ||
| "task": "Process Termination" | ||
| } | ||
| }, | ||
| { | ||
| "@timestamp": "2019-11-14T21:28:18.4605129Z", | ||
| "event": { | ||
| "action": "exited-process", | ||
| "category": "process", | ||
| "code": 4689, | ||
| "kind": "event", | ||
| "module": "security", | ||
| "provider": "Microsoft-Windows-Security-Auditing", | ||
| "type": "process_end" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "A process has exited.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1610636575-2290000098-1654242922-1000\n\tAccount Name:\t\tvagrant\n\tAccount Domain:\t\tVAGRANT\n\tLogon ID:\t\t0x274A2\n\nProcess Information:\n\tProcess ID:\t0xac8\n\tProcess Name:\tC:\\Windows\\System32\\wevtutil.exe\n\tExit Status:\t0x0", | ||
| "process": { | ||
| "executable": "C:\\Windows\\System32\\wevtutil.exe", | ||
| "name": "wevtutil.exe", | ||
| "pid": 2760 | ||
| }, | ||
| "user": { | ||
| "domain": "VAGRANT", | ||
| "id": "S-1-5-21-1610636575-2290000098-1654242922-1000", | ||
| "name": "vagrant" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "vagrant", | ||
| "event_data": { | ||
| "Status": "0x0", | ||
| "SubjectDomainName": "VAGRANT", | ||
| "SubjectLogonId": "0x274a2", | ||
| "SubjectUserName": "vagrant", | ||
| "SubjectUserSid": "S-1-5-21-1610636575-2290000098-1654242922-1000" | ||
| }, | ||
| "event_id": 4689, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 4, | ||
| "thread": { | ||
| "id": 5636 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 7544, | ||
| "task": "Process Termination" | ||
| } | ||
| } | ||
| ] |