Windows Events
The computer attempted to validate the credentials for an account
Event ID 4776
Security
Audit Credential Validation
Main fields
IP address
IP
Windows
IP
ELK
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
User name
TargetUserName
Windows
Logon Account
ELK
winlog.event_data.TargetUserName
Important field
Status
Windows
Error Code
ELK
winlog.event_data.Status
Fields
| Windows Raw | Windows | ELK |
|---|---|---|
| PackageName | Authentication Package | winlog.event_data.PackageName |
| TargetUserName | Logon Account | winlog.event_data.TargetUserName |
| Workstation | Source Workstation | winlog.event_data.Workstation |
| Status | Error Code | winlog.event_data.Status |
| IP System field | IP System field | - |
| Computer System field | Computer System field | winlog.computer_name |
| ProcessPID System field | ProcessPID System field | winlog.process.pid |
| ThreadID System field | ThreadID System field | winlog.process.thread.id |
Sample Event
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4776</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14336</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2015-07-25T04:38:11.003163100Z" />
<EventRecordID>165437</EventRecordID>
<Correlation />
<Execution ProcessID="500" ThreadID="532" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
<EventData>
<Data Name="PackageName">MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0</Data>
<Data Name="TargetUserName">dadmin</Data>
<Data Name="Workstation">WIN81</Data>
<Data Name="Status">0xc0000234</Data>
</EventData>
</Event>