DFIRHub

Windows event log ยท Security4616 The system time was changed

  • Security
  • 5 fields
  • Security.evtx
  • Microsoft-Windows-Security-Auditing

Fields EvtxECmd extracts

5 columns in the EvtxECmd CSV

  • UserName%domain%\%user% (%sid%)
    • %domain% = /Event/EventData/Data[@Name="SubjectDomainName"]
    • %user% = /Event/EventData/Data[@Name="SubjectUserName"]
    • %sid% = /Event/EventData/Data[@Name="SubjectUserSid"]
  • ExecutableInfo%ProcessName%
    • %ProcessName% = /Event/EventData/Data[@Name="ProcessName"]
  • PayloadData1PreviousTime: %PreviousTime%
    • %PreviousTime% = /Event/EventData/Data[@Name="PreviousTime"]
  • PayloadData2NewTime: %NewTime%
    • %NewTime% = /Event/EventData/Data[@Name="NewTime"]
  • PayloadData3LogonId: %SubjectLogonId%
    • %SubjectLogonId% = /Event/EventData/Data[@Name="SubjectLogonId"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d"/>
    <EventID>4616</EventID>
    <Version>1</Version>
    <Level>0</Level>
    <Task>12288</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2020-11-24 15:18:34.0000000"/>
    <EventRecordID>9403</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="56"/>
    <Channel>Security</Channel>
    <Computer>IEWIN7</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-1610009768-122519599-941061767-1000</Data>
    <Data Name="SubjectUserName">IEUser</Data>
    <Data Name="SubjectDomainName">IEWIN7</Data>
    <Data Name="SubjectLogonId">0x1011B</Data>
    <Data Name="PreviousTime">2020-11-27 15:18:34.6217800</Data>
    <Data Name="NewTime">2020-11-24 15:18:34.0000000</Data>
    <Data Name="ProcessId">0x798</Data>
    <Data Name="ProcessName">C:\Windows\System32\rundll32.exe</Data>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4616.map(opens in new tab) by Gabriele Zambelli @gazambelli and contributors(opens in new tab), MIT License(opens in new tab)