Windows оқиғалары
A computer account was changed
Компьютер тіркелгісі өзгертілді
Event ID 4742
Security
Audit Computer Account Management
Негізгі өрістер
IP мекенжайы
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Компьютер атауы
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Пайдаланушы аты
TargetUserName
Windows
Computer Account That Was Changed: Account Name
ELK
winlog.event_data.TargetUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Маңызды өріс
SubjectUserName
Windows
Subject: Account Name
ELK
winlog.event_data.SubjectUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Өрістер
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| SubjectUserSid | Subject: Security ID | winlog.event_data.SubjectUserSid | - | - | - |
| SubjectUserName | Subject: Account Name | winlog.event_data.SubjectUserName | - | - | - |
| SubjectDomainName | Subject: Account Domain | winlog.event_data.SubjectDomainName | - | - | - |
| SubjectLogonId | Subject: Logon ID | winlog.event_data.SubjectLogonId | - | - | - |
| TargetSid | Computer Account That Was Changed: Security ID | winlog.event_data.TargetSid | - | - | - |
| TargetUserName | Computer Account That Was Changed: Account Name | winlog.event_data.TargetUserName | - | - | - |
| TargetDomainName | Computer Account That Was Changed: Account Domain | winlog.event_data.TargetDomainName | - | - | - |
| SamAccountName | Changed Attributes: SAM Account Name | winlog.event_data.SamAccountName | - | - | - |
| DisplayName | Changed Attributes: Display Name | winlog.event_data.DisplayName | - | - | - |
| UserPrincipalName | Changed Attributes: User Principal Name | winlog.event_data.UserPrincipalName | - | - | - |
| HomeDirectory | Changed Attributes: Home Directory | winlog.event_data.HomeDirectory | - | - | - |
| HomePath | Changed Attributes: Home Drive | winlog.event_data.HomePath | - | - | - |
| ScriptPath | Changed Attributes: Script Path | winlog.event_data.ScriptPath | - | - | - |
| ProfilePath | Changed Attributes: Profile Path | winlog.event_data.ProfilePath | - | - | - |
| UserWorkstations | Changed Attributes: User Workstations | winlog.event_data.UserWorkstations | - | - | - |
| PasswordLastSet | Changed Attributes: Password Last Set | winlog.event_data.PasswordLastSet | - | - | - |
| AccountExpires | Changed Attributes: Account Expires | winlog.event_data.AccountExpires | - | - | - |
| PrimaryGroupId | Changed Attributes: Primary Group ID | winlog.event_data.PrimaryGroupId | - | - | - |
| AllowedToDelegateTo | Changed Attributes: AllowedToDelegateTo | winlog.event_data.AllowedToDelegateTo | - | - | - |
| OldUacValue | Changed Attributes: Old UAC Value | winlog.event_data.OldUacValue | - | - | - |
| NewUacValue | Changed Attributes: New UAC Value | winlog.event_data.NewUacValue | - | - | - |
| UserAccountControl | Changed Attributes: User Account Control | winlog.event_data.UserAccountControl | - | - | - |
| UserParameters | Changed Attributes: User Parameters | winlog.event_data.UserParameters | - | - | - |
| SidHistory | Changed Attributes: SID History | winlog.event_data.SidHistory | - | - | - |
| LogonHours | Changed Attributes: Logon Hours | winlog.event_data.LogonHours | - | - | - |
| DnsHostName | Changed Attributes: DNS Host Name | winlog.event_data.DnsHostName | - | - | - |
| ServicePrincipalNames | Changed Attributes: Service Principal Names | winlog.event_data.ServicePrincipalNames | - | - | - |
| PrivilegeList | Additional Information: Privileges | winlog.event_data.PrivilegeList | - | - | - |
| IP Жүйелік өріс | IP Жүйелік өріс | - | - | - | - |
| Computer Жүйелік өріс | Computer Жүйелік өріс | winlog.computer_name | - | - | - |
| ProcessID Жүйелік өріс | ProcessID Жүйелік өріс | winlog.process.pid | - | - | - |
| ThreadID Жүйелік өріс | ThreadID Жүйелік өріс | winlog.process.thread.id | - | - | - |
Оқиға мысалы
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4742</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13825</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-03T10:30:54.1263850Z" />
<EventRecordID>176023</EventRecordID>
<Correlation />
<Execution ProcessID="848" ThreadID="7460" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="ComputerAccountChange">-</Data>
<Data Name="TargetUserName">GHOSTTQHELQZJ$</Data>
<Data Name="TargetDomainName">SOCPEDIA</Data>
<Data Name="TargetSid">S-1-5-21-1838030176-2987033226-1986555923-1119</Data>
<Data Name="SubjectUserSid">S-1-5-21-1838030176-2987033226-1986555923-1118</Data>
<Data Name="SubjectUserName">user02</Data>
<Data Name="SubjectDomainName">SOCPEDIA</Data>
<Data Name="SubjectLogonId">0xdaf2ae3</Data>
<Data Name="PrivilegeList">-</Data>
<Data Name="SamAccountName">-</Data>
<Data Name="DisplayName">-</Data>
<Data Name="UserPrincipalName">-</Data>
<Data Name="HomeDirectory">-</Data>
<Data Name="HomePath">-</Data>
<Data Name="ScriptPath">-</Data>
<Data Name="ProfilePath">-</Data>
<Data Name="UserWorkstations">-</Data>
<Data Name="PasswordLastSet">-</Data>
<Data Name="AccountExpires">-</Data>
<Data Name="PrimaryGroupId">-</Data>
<Data Name="AllowedToDelegateTo">-</Data>
<Data Name="OldUacValue">-</Data>
<Data Name="NewUacValue">-</Data>
<Data Name="UserAccountControl">-</Data>
<Data Name="UserParameters">-</Data>
<Data Name="SidHistory">-</Data>
<Data Name="LogonHours">-</Data>
<Data Name="DnsHostName">-</Data>
<Data Name="ServicePrincipalNames">-</Data>
</EventData>
</Event>