Windows оқиғалары
An attempt was made to reset an account's password
Тіркелгінің құпия сөзін қалпына келтіру әрекеті жасалды
AI
Event ID 4724
Security
Audit User Account Management
Негізгі өрістер
IP мекенжайы
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Компьютер атауы
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Пайдаланушы аты
TargetUserName
Windows
Target Account: Account Name
ELK
winlog.event_data.TargetUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Маңызды өріс
SubjectUserName
Windows
Subject: Account Name
ELK
winlog.event_data.SubjectUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Өрістер
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| SubjectUserSid | Subject: Security ID | winlog.event_data.SubjectUserSid | - | - | - |
| SubjectUserName | Subject: Account Name | winlog.event_data.SubjectUserName | - | - | - |
| SubjectDomainName | Subject: Account Domain | winlog.event_data.SubjectDomainName | - | - | - |
| SubjectLogonId | Subject: Logon ID | winlog.event_data.SubjectLogonId | - | - | - |
| TargetSid | Target Account: Security ID | winlog.event_data.TargetSid | - | - | - |
| TargetUserName | Target Account: Account Name | winlog.event_data.TargetUserName | - | - | - |
| TargetDomainName | Target Account: Account Domain | winlog.event_data.TargetDomainName | - | - | - |
| IP Жүйелік өріс | IP Жүйелік өріс | - | - | - | - |
| Computer Жүйелік өріс | Computer Жүйелік өріс | winlog.computer_name | - | - | - |
| ProcessID Жүйелік өріс | ProcessID Жүйелік өріс | winlog.process.pid | - | - | - |
| ThreadID Жүйелік өріс | ThreadID Жүйелік өріс | winlog.process.thread.id | - | - | - |
Оқиға мысалы
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4724</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-03T10:30:53.9411197Z" />
<EventRecordID>176022</EventRecordID>
<Correlation ActivityID="{17aef5e7-1de8-0001-e4f6-ae17e81ddd01}" />
<Execution ProcessID="848" ThreadID="7460" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetUserName">GHOSTTQHELQZJ$</Data>
<Data Name="TargetDomainName">SOCPEDIA</Data>
<Data Name="TargetSid">S-1-5-21-1838030176-2987033226-1986555923-1119</Data>
<Data Name="SubjectUserSid">S-1-5-21-1838030176-2987033226-1986555923-1118</Data>
<Data Name="SubjectUserName">user02</Data>
<Data Name="SubjectDomainName">SOCPEDIA</Data>
<Data Name="SubjectLogonId">0xdaf2ae3</Data>
</EventData>
</Event>