Windows оқиғалары
An attempt was made to reset an account's password
Тіркелгінің құпия сөзін қалпына келтіру әрекеті жасалды
AI
Event ID 4724
Security
Audit User Account Management
Негізгі өрістер
IP мекенжайы
IP
Windows
IP
ELK
-
Компьютер атауы
Computer
Windows
Computer
ELK
winlog.computer_name
Пайдаланушы аты
TargetUserName
Windows
Target Account: Account Name
ELK
winlog.event_data.TargetUserName
Маңызды өріс
SubjectUserName
Windows
Subject: Account Name
ELK
winlog.event_data.SubjectUserName
Өрістер
| Windows Raw | Windows | ELK |
|---|---|---|
| SubjectUserSid | Subject: Security ID | winlog.event_data.SubjectUserSid |
| SubjectUserName | Subject: Account Name | winlog.event_data.SubjectUserName |
| SubjectDomainName | Subject: Account Domain | winlog.event_data.SubjectDomainName |
| SubjectLogonId | Subject: Logon ID | winlog.event_data.SubjectLogonId |
| TargetSid | Target Account: Security ID | winlog.event_data.TargetSid |
| TargetUserName | Target Account: Account Name | winlog.event_data.TargetUserName |
| TargetDomainName | Target Account: Account Domain | winlog.event_data.TargetDomainName |
| IP Жүйелік өріс | IP Жүйелік өріс | - |
| Computer Жүйелік өріс | Computer Жүйелік өріс | winlog.computer_name |
| ProcessPID Жүйелік өріс | ProcessPID Жүйелік өріс | winlog.process.pid |
| ThreadID Жүйелік өріс | ThreadID Жүйелік өріс | winlog.process.thread.id |
Оқиға мысалы
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4724</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-03T10:30:53.9411197Z" />
<EventRecordID>176022</EventRecordID>
<Correlation ActivityID="{17aef5e7-1de8-0001-e4f6-ae17e81ddd01}" />
<Execution ProcessID="848" ThreadID="7460" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetUserName">GHOSTTQHELQZJ$</Data>
<Data Name="TargetDomainName">SOCPEDIA</Data>
<Data Name="TargetSid">S-1-5-21-1838030176-2987033226-1986555923-1119</Data>
<Data Name="SubjectUserSid">S-1-5-21-1838030176-2987033226-1986555923-1118</Data>
<Data Name="SubjectUserName">user02</Data>
<Data Name="SubjectDomainName">SOCPEDIA</Data>
<Data Name="SubjectLogonId">0xdaf2ae3</Data>
</EventData>
</Event>