DFIRHub

Windows event log ยท Security6272 Network Policy Server granted access to a user

  • Security
  • 5 fields
  • Security.evtx
  • Microsoft-Windows-Security-Auditing

Fields EvtxECmd extracts

5 columns in the EvtxECmd CSV

  • RemoteHost%ipAddress%
    • %ipAddress% = /Event/EventData/Data[@Name="CallingStationID"]
  • UserName%domain%\%user% (%sid%)
    • %domain% = /Event/EventData/Data[@Name="SubjectDomainName"]
    • %user% = /Event/EventData/Data[@Name="SubjectUserName"]
    • %sid% = /Event/EventData/Data[@Name="SubjectUserSid"]
  • PayloadData1%clientname% (%clientipaddress%)
    • %clientname% = /Event/EventData/Data[@Name="ClientName"]
    • %clientipaddress% = /Event/EventData/Data[@Name="ClientIPAddress"]
  • PayloadData2Policy name: %ProxyPolicyName%
    • %ProxyPolicyName% = /Event/EventData/Data[@Name="ProxyPolicyName"]
  • PayloadData3Auth Server: %AuthenticationServer%
    • %AuthenticationServer% = /Event/EventData/Data[@Name="AuthenticationServer"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d"/>
    <EventID>6272</EventID>
    <Version>2</Version>
    <Level>0</Level>
    <Task>12552</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="XXXXX 07:05:42.5818615"/>
    <EventRecordID>18469426</EventRecordID>
    <Correlation ActivityID="d2996340-cd6a-0001-4a63-99d26acdd901"/>
    <Execution ProcessID="592" ThreadID="3292"/>
    <Channel>Security</Channel>
    <Computer>XXXXXX</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-1234</Data>
    <Data Name="SubjectUserName">username</Data>
    <Data Name="SubjectDomainName">domain</Data>
    <Data Name="FullyQualifiedSubjectUserName">userfqdn</Data>
    <Data Name="SubjectMachineSID">S-1-0-0</Data>
    <Data Name="SubjectMachineName">-</Data>
    <Data Name="FullyQualifiedSubjectMachineName">-</Data>
    <Data Name="CalledStationID">internalIP</Data>
    <Data Name="CallingStationID">remoteIP</Data>
    <Data Name="NASIPv4Address">internalIP</Data>
    <Data Name="NASIPv6Address">-</Data>
    <Data Name="NASIdentifier">-</Data>
    <Data Name="NASPortType">Virtual</Data>
    <Data Name="NASPort">199852032</Data>
    <Data Name="ClientName">XXX</Data>
    <Data Name="ClientIPAddress">internalIP</Data>
    <Data Name="ProxyPolicyName">Use Windows authentication for all users</Data>
    <Data Name="NetworkPolicyName">POLICYNAME</Data>
    <Data Name="AuthenticationProvider">Windows</Data>
    <Data Name="AuthenticationServer">XXXXXXXXXXXX</Data>
    <Data Name="AuthenticationType">PAP</Data>
    <Data Name="EAPType">-</Data>
    <Data Name="AccountSessionIdentifier">-</Data>
    <Data Name="LoggingResult">Accounting information was written to the local log file.</Data>
  </EventData>

References

1 link

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_6272.map(opens in new tab) by Phill Moore and contributors(opens in new tab), MIT License(opens in new tab)