Windows оқиғалары
A network share object was accessed
Желіні ортақ пайдалану нысанына қол жеткізілді
AI
Event ID 5140
Security
Audit File Share
Негізгі өрістер
IP мекенжайы
IP
Windows
IP
ELK
-
Компьютер атауы
Computer
Windows
Computer
ELK
winlog.computer_name
Пайдаланушы аты
SubjectUserName
Windows
Subject: Account Name
ELK
winlog.event_data.SubjectUserName
Маңызды өріс
IpAddress
Windows
Network Information: Source Network Address
ELK
winlog.event_data.IpAddress
Өрістер
| Windows Raw | Windows | ELK |
|---|---|---|
| SubjectUserSid | Subject: Security ID | winlog.event_data.SubjectUserSid |
| SubjectUserName | Subject: Account Name | winlog.event_data.SubjectUserName |
| SubjectDomainName | Subject: Account Domain | winlog.event_data.SubjectDomainName |
| SubjectLogonId | Subject: Logon ID | winlog.event_data.SubjectLogonId |
| ObjectType | Network Information: Object Type | winlog.event_data.ObjectType |
| IpAddress | Network Information: Source Network Address | winlog.event_data.IpAddress |
| IpPort | Network Information: Client Port | winlog.event_data.IpPort |
| ShareName | Share Information: Share Name | winlog.event_data.ShareName |
| ShareLocalPath | Share Information: Share Path | winlog.event_data.ShareLocalPath |
| AccessMask | Access Request Information: Access Mask | winlog.event_data.AccessMask |
| AccessList | Access Request Information: Accesses | winlog.event_data.AccessList |
| IP Жүйелік өріс | IP Жүйелік өріс | - |
| Computer Жүйелік өріс | Computer Жүйелік өріс | winlog.computer_name |
| ProcessPID Жүйелік өріс | ProcessPID Жүйелік өріс | winlog.process.pid |
| ThreadID Жүйелік өріс | ThreadID Жүйелік өріс | winlog.process.thread.id |
Оқиға мысалы
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>5140</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>12808</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-02T14:45:56.2495692Z" />
<EventRecordID>26397</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="9100" />
<Channel>Security</Channel>
<Computer>ADCS.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-5-21-1838030176-2987033226-1986555923-1116</Data>
<Data Name="SubjectUserName">GHOSTPYUVHAOB$</Data>
<Data Name="SubjectDomainName">SOCPEDIA</Data>
<Data Name="SubjectLogonId">0xb4a8aaa</Data>
<Data Name="ObjectType">File</Data>
<Data Name="IpAddress">192.168.0.237</Data>
<Data Name="IpPort">44622</Data>
<Data Name="ShareName">\\*\IPC$</Data>
<Data Name="ShareLocalPath" />
<Data Name="AccessMask">0x1</Data>
<Data Name="AccessList">%%4416</Data>
</EventData>
</Event>