Skip to content

system/security: add test cases for events 4738 and 4742 #3944

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
efd6 merged 1 commit into from
Aug 24, 2022
Merged

system/security: add test cases for events 4738 and 4742 #3944

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion packages/system/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,17 @@
# newer versions go on top
- version: "1.19.3"
changes:
- description: Add test cases for events 4738 and 4742.
type: bugfix
link: https://github.com/elastic/integrations/pull/3944
- version: "1.19.2"
changes:
- description: Add mapping for event.original for auth and security data streams.
type: bugfix
link: https://github.com/elastic/integrations/pull/4012
- version: "1.19.1"
changes:
- description: Fix handling of security events 4674, 4738 and 3742.
- description: Fix handling of security events 4674, 4738 and 4742.
type: bugfix
link: https://github.com/elastic/integrations/pull/3930
- version: "1.19.0"
Expand Down
72 changes: 72 additions & 0 deletions packages/system/data_stream/security/_dev/test/pipeline/test-4738.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
{
"events": [
{
"@timestamp": "2021-11-11T17:14:52.001Z",
"event": {
"action": "User Account Management",
"code": "4738",
"kind": "event",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing"
},
"host": {
"name": "DC_TEST2k12"
},
"log": {
"level": "information"
},
"message": "A user account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-2794\n\tAccount Name:\t\tat_adm\n\tAccount Domain:\t\tTEST\n\tLogon ID:\t\t0x5E2887\n\nTarget Account:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-8884\n\tAccount Name:\t\tanatest1\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\tanatest12@TEST\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t-\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-",
"winlog": {
"channel": "Security",
"computer_name": "DC_TEST2k12",
"event_data": {
"AccountExpires": "-",
"AllowedToDelegateTo": "-",
"DisplayName": "-",
"Dummy": "-",
"HomeDirectory": "-",
"HomePath": "-",
"LogonHours": "-",
"NewUacValue": "-",
"OldUacValue": "-",
"PasswordLastSet": "-",
"PrimaryGroupId": "-",
"PrivilegeList": "-",
"ProfilePath": "-",
"SamAccountName": "-",
"ScriptPath": "-",
"SidHistory": "-",
"SubjectDomainName": "TEST",
"SubjectLogonId": "0x5e2887",
"SubjectUserName": "at_adm",
"SubjectUserSid": "S-1-5-21-1717121054-434620538-60925301-2794",
"TargetDomainName": "TEST",
"TargetSid": "S-1-5-21-1717121054-434620538-60925301-8884",
"TargetUserName": "anatest1",
"UserAccountControl": "-",
"UserParameters": "-",
"UserPrincipalName": "anatest12@TEST",
"UserWorkstations": "-"
},
"event_id": "4738",
"keywords": [
"Audit Success"
],
"level": "information",
"opcode": "Info",
"outcome": "success",
"process": {
"pid": 604,
"thread": {
"id": 864
}
},
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"provider_name": "Microsoft-Windows-Security-Auditing",
"record_id": 18232108,
"task": "User Account Management",
"time_created": "2022-08-01T08:49:58.8259888Z"
}
}
]
}
101 changes: 101 additions & 0 deletions packages/system/data_stream/security/_dev/test/pipeline/test-4738.json-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
{
"expected": [
{
"@timestamp": "2022-08-01T08:49:58.825Z",
"ecs": {
"version": "8.0.0"
},
"event": {
"action": "modified-user-account",
"category": [
"iam"
],
"code": "4738",
"kind": "event",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing",
"type": [
"user",
"change"
]
},
"host": {
"name": "DC_TEST2k12"
},
"log": {
"level": "information"
},
"message": "A user account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-2794\n\tAccount Name:\t\tat_adm\n\tAccount Domain:\t\tTEST\n\tLogon ID:\t\t0x5E2887\n\nTarget Account:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-8884\n\tAccount Name:\t\tanatest1\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\tanatest12@TEST\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t-\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-",
"related": {
"user": [
"at_adm",
"anatest1"
]
},
"user": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm",
"target": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-8884",
"name": "anatest1"
}
},
"winlog": {
"channel": "Security",
"computer_name": "DC_TEST2k12",
"event_data": {
"AccountExpires": "-",
"AllowedToDelegateTo": "-",
"DisplayName": "-",
"Dummy": "-",
"HomeDirectory": "-",
"HomePath": "-",
"LogonHours": "-",
"NewUacValue": "-",
"OldUacValue": "-",
"PasswordLastSet": "-",
"PrimaryGroupId": "-",
"PrivilegeList": "-",
"ProfilePath": "-",
"SamAccountName": "-",
"ScriptPath": "-",
"SidHistory": "-",
"SubjectDomainName": "TEST",
"SubjectLogonId": "0x5e2887",
"SubjectUserName": "at_adm",
"SubjectUserSid": "S-1-5-21-1717121054-434620538-60925301-2794",
"TargetDomainName": "TEST",
"TargetSid": "S-1-5-21-1717121054-434620538-60925301-8884",
"TargetUserName": "anatest1",
"UserAccountControl": "-",
"UserParameters": "-",
"UserPrincipalName": "anatest12@TEST",
"UserWorkstations": "-"
},
"event_id": "4738",
"keywords": [
"Audit Success"
],
"level": "information",
"logon": {
"id": "0x5e2887"
},
"opcode": "Info",
"outcome": "success",
"process": {
"pid": 604,
"thread": {
"id": 864
}
},
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"provider_name": "Microsoft-Windows-Security-Auditing",
"record_id": "18232108",
"task": "User Account Management",
"time_created": "2022-08-01T08:49:58.8259888Z"
}
}
]
}
74 changes: 74 additions & 0 deletions packages/system/data_stream/security/_dev/test/pipeline/test-4742.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
{
"events": [
{
"@timestamp": "2021-11-11T17:14:52.001Z",
"event": {
"action": "Computer Account Management",
"code": "4742",
"kind": "event",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing"
},
"host": {
"name": "DC_TEST2k12.TEST."
},
"log": {
"level": "information"
},
"message": "A computer account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-7\n\tAccount Name:\t\tANONYMOUS LOGON\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E6\n\nComputer Account That Was Changed:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-11556\n\tAccount Name:\t\tTEST4642$\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\t-\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t01/08/2022 10:56:47\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\tDNS Host Name:\t\t-\n\tService Principal Names:\t-\n\nAdditional Information:\n\tPrivileges:\t\t-",
"winlog": {
"channel": "Security",
"computer_name": "DC_TEST2k12.TEST.",
"event_data": {
"AccountExpires": "-",
"AllowedToDelegateTo": "-",
"ComputerAccountChange": "-",
"DisplayName": "-",
"DnsHostName": "-",
"HomeDirectory": "-",
"HomePath": "-",
"LogonHours": "-",
"NewUacValue": "-",
"OldUacValue": "-",
"PasswordLastSet": "01/08/2022 10:56:47",
"PrimaryGroupId": "-",
"PrivilegeList": "-",
"ProfilePath": "-",
"SamAccountName": "-",
"ScriptPath": "-",
"ServicePrincipalNames": "-",
"SidHistory": "-",
"SubjectDomainName": "NT AUTHORITY",
"SubjectLogonId": "0x3e6",
"SubjectUserName": "ANONYMOUS LOGON",
"SubjectUserSid": "S-1-5-7",
"TargetDomainName": "TEST",
"TargetSid": "S-1-5-21-1717121054-434620538-60925301-11556",
"TargetUserName": "TEST4642$",
"UserAccountControl": "-",
"UserParameters": "-",
"UserPrincipalName": "-",
"UserWorkstations": "-"
},
"event_id": "4742",
"keywords": [
"Audit Success"
],
"level": "information",
"opcode": "Info",
"outcome": "success",
"process": {
"pid": 604,
"thread": {
"id": 864
}
},
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"provider_name": "Microsoft-Windows-Security-Auditing",
"record_id": 18232202,
"task": "Computer Account Management",
"time_created": "2022-08-01T08:56:47.9740262Z"
}
}
]
}
104 changes: 104 additions & 0 deletions packages/system/data_stream/security/_dev/test/pipeline/test-4742.json-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
{
"expected": [
{
"@timestamp": "2022-08-01T08:56:47.974Z",
"ecs": {
"version": "8.0.0"
},
"event": {
"action": "changed-computer-account",
"category": [
"iam"
],
"code": "4742",
"kind": "event",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing",
"type": [
"change",
"admin"
]
},
"host": {
"name": "DC_TEST2k12.TEST."
},
"log": {
"level": "information"
},
"message": "A computer account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-7\n\tAccount Name:\t\tANONYMOUS LOGON\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E6\n\nComputer Account That Was Changed:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-11556\n\tAccount Name:\t\tTEST4642$\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\t-\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t01/08/2022 10:56:47\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\tDNS Host Name:\t\t-\n\tService Principal Names:\t-\n\nAdditional Information:\n\tPrivileges:\t\t-",
"related": {
"user": [
"ANONYMOUS LOGON"
]
},
"user": {
"domain": "NT AUTHORITY",
"id": "S-1-5-7",
"name": "ANONYMOUS LOGON"
},
"winlog": {
"channel": "Security",
"computerObject": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-11556",
"name": "TEST4642$"
},
"computer_name": "DC_TEST2k12.TEST.",
"event_data": {
"AccountExpires": "-",
"AllowedToDelegateTo": "-",
"ComputerAccountChange": "-",
"DisplayName": "-",
"DnsHostName": "-",
"HomeDirectory": "-",
"HomePath": "-",
"LogonHours": "-",
"NewUacValue": "-",
"OldUacValue": "-",
"PasswordLastSet": "01/08/2022 10:56:47",
"PrimaryGroupId": "-",
"PrivilegeList": [
"-"
],
"ProfilePath": "-",
"SamAccountName": "-",
"ScriptPath": "-",
"ServicePrincipalNames": "-",
"SidHistory": "-",
"SubjectDomainName": "NT AUTHORITY",
"SubjectLogonId": "0x3e6",
"SubjectUserName": "ANONYMOUS LOGON",
"SubjectUserSid": "S-1-5-7",
"TargetDomainName": "TEST",
"TargetSid": "S-1-5-21-1717121054-434620538-60925301-11556",
"TargetUserName": "TEST4642$",
"UserAccountControl": "-",
"UserParameters": "-",
"UserPrincipalName": "-",
"UserWorkstations": "-"
},
"event_id": "4742",
"keywords": [
"Audit Success"
],
"level": "information",
"logon": {
"id": "0x3e6"
},
"opcode": "Info",
"outcome": "success",
"process": {
"pid": 604,
"thread": {
"id": 864
}
},
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"provider_name": "Microsoft-Windows-Security-Auditing",
"record_id": "18232202",
"task": "Computer Account Management",
"time_created": "2022-08-01T08:56:47.9740262Z"
}
}
]
}
2 changes: 1 addition & 1 deletion packages/system/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 1.0.0
name: system
title: System
version: 1.19.2
version: 1.19.3
license: basic
description: Collect system logs and metrics from your servers with Elastic Agent.
type: integration
Expand Down