События Windows
The computer attempted to validate the credentials for an account
Компьютер попытался проверить учетные данные учетной записи
Event ID 4776
Security
Audit Credential Validation
Основные поля
IP-адрес
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя компьютера
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя пользователя
TargetUserName
Windows
Logon Account
ELK
winlog.event_data.TargetUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Важное поле
Status
Windows
Error Code
ELK
winlog.event_data.Status
Microsoft Sentinel
-
QRadar
-
Splunk
-
Поля
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| PackageName | Authentication Package | winlog.event_data.PackageName | - | - | - |
| TargetUserName | Logon Account | winlog.event_data.TargetUserName | - | - | - |
| Workstation | Source Workstation | winlog.event_data.Workstation | - | - | - |
| Status | Error Code | winlog.event_data.Status | - | - | - |
| IP Системное поле | IP Системное поле | - | - | - | - |
| Computer Системное поле | Computer Системное поле | winlog.computer_name | - | - | - |
| ProcessID Системное поле | ProcessID Системное поле | winlog.process.pid | - | - | - |
| ThreadID Системное поле | ThreadID Системное поле | winlog.process.thread.id | - | - | - |
Пример события
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4776</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14336</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2015-07-25T04:38:11.003163100Z" />
<EventRecordID>165437</EventRecordID>
<Correlation />
<Execution ProcessID="500" ThreadID="532" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
<EventData>
<Data Name="PackageName">MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0</Data>
<Data Name="TargetUserName">dadmin</Data>
<Data Name="Workstation">WIN81</Data>
<Data Name="Status">0xc0000234</Data>
</EventData>
</Event>