deardaniel/secdata-raw huggingface dataset:
Windows Forensic Artifact Reference: zone identifier

# NTFS Zone Identifiers
Zone Identifiers are an artifact that reside in alternate data streams within an NTFS volume. This artifact is used to determine the origins of a file on a disk.

> [!NOTE]
> In Windows XP, only executable files will be tagged with a Zone Identifier. Later operating systems will tag all files.

### Analysis Value
 - [x] File - Creation
 - [x] File - Origin

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP

## Artifact Location(s)
This artifact is present in an alternate data stream (ADS) of the file of interest for analysis. 

## Artifact Parsers
 - FTK Imager
 - KAPE
 - MFTEcmd

## Artifact Interpretation
The following Zone IDs are available:

| Zone ID | Description |
| - | - |
| -1 | No Zone |
| 0 | My Computer |
| 1 | Intranet |
| 2 | Trusted |
| 3 | Internet (AKA Mark of the Web) |
| 4 | Untrusted |

A Zone Identifier of 4 indicates that Microsoft SmartScreen has determined a file is suspicious.

As an example, a Zone.Identifier file may look like this:

```
[ZoneTransfer]
ZoneId=3
ReferrerUrl=http://example.com/example.exe
HostUrl=http://example.com/example.exe
```

In this example, in addition to the Zone Identifier being present, the associated URLs are also noted as well. This behavior is dependent on the application used to download the file. Browsers such as Chrome and Microsoft Edge will append this information to the Zone.Identifier file.

> [!IMPORTANT]
> Some software does not assign Zone Identifiers to files that originate from the internet, such as git. Other software, such as 7zip, may or may not assign Zone Identifiers.
Windows Forensic Artifact Reference: recycle bin files

# Recycle Bin $I/$R Files
In modern versions of Windows, when a file is deleted, it is sent to the Recycle Bin first. Under the hood this constitutes the creation of two unique files prepended by `$I` and `$R` and appended with the original file's extension such as:

 - `$RMYY8AS.txt`
 - `$IMYY8AS.txt`

The `$I` file contains information about the deleted file. The `$R` file contains the full contents of that deleted file.

### Analysis Value
 - [x] Account - Security Identifier (SID)
 - [x] File - Deletion
 - [x] File - Size
 - [x] File - Path

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista

## Artifact Location(s)
 - `C:\$Recycle.Bin\{USER_SID}`

## Artifact Parsers
 - KAPE (Extraction and Parsing)
 - [RBCmd](https://github.com/EricZimmerman/RBCmd)

## Artifact Interpretation
The presence of this artifact indicates that a file was deleted and sent to the recycle bin.

The user who deleted the file will have their SID shown as the parent directory for the `$I` and `$R` files, for example:

 - `C:\$Recycle.Bin\S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1000\$RMYY8AS.txt`
 - `C:\$Recycle.Bin\S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1000\$IMYY8AS.txt`

In this case, `S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1000` is the User SID. 

The `$R` file contains the full contents of the original deleted file. 

The `$I` file contains the following data:

 - Size of the original file
 - Full path of the original file
 - Deletion time and date

<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: evtx 1503 user gpo success

# System/1503: The Group Policy settings for the user were processed successfully
This event indicates that Group Policy Object processing for a specific user was completed, and that new Group Policy Objects were found and applied to the user. It is the result of either:

 - A manual/scheduled user GPO update: [Microsoft-Windows-GroupPolicy/Operational/4005: Starting manual processing of policy for user](/group-policy/evtx-4005-user-manual-gpo-processing-start.md)
 - A user logon GPO update: [Microsoft-Windows-GroupPolicy/Operational/4001: Starting user logon Policy processing](/group-policy/evtx-4001-user-logon-gpo-processing-start.md)

### Analysis Value
 - [x] Network - Evidence of Network Activity

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista


## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\System.evtx`

## Artifact Interpretation

| XML Path                              | Interpretation  |
| ------------------------------------- | --------------- |
| System/Correlation ActivityID            | The ActivityID for this GPO update. This can be used to filter/correlate other events relating to this activity in both the System event log as well as the Group Policy Operational log. |
| EventData/NumberOfGroupPolicyObjects            | How many GPOs were processed. |

If new User Group Policy Objects were found, [Microsoft-Windows-GroupPolicy/Operational/5312: List of applicable Group Policy objects](/group-policy/evtx-5312-list-of-gpo.md) will be generated with the same `System/Correlation ActivityID `, providing a list of all the applicable GPOs.

## Example
```
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" /> 
  <EventID>1503</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>1</Opcode> 
  <Keywords>0x[PII_REDACTED]000000</Keywords> 
  <TimeCreated SystemTime="2024-04-22T19:48:04.6896574Z" /> 
  <EventRecordID>565</EventRecordID> 
  <Correlation ActivityID="{20ff7f77-1fab-41db-af00-72215ae5c002}" /> 
  <Execution ProcessID="13044" ThreadID="1160" /> 
  <Channel>System</Channel> 
  <Computer>DESKTOP-88KIKM6.example.lan</Computer> 
  <Security UserID="S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1103" /> 
  </System>
- <EventData>
  <Data Name="SupportInfo1">1</Data> 
  <Data Name="SupportInfo2">4430</Data> 
  <Data Name="ProcessingMode">0</Data> 
  <Data Name="ProcessingTimeInMilliseconds">1344</Data> 
  <Data Name="DCName">\\nndc01.example.lan</Data> 
  <Data Name="NumberOfGroupPolicyObjects">2</Data> 
  </EventData>
  </Event>
```

<sup><sub>This example was produced on Windows 10, Version 10.0.19045 Build 19045</sub></sup>
Windows Forensic Artifact Reference: evtx 4001 user logon gpo processing start

# Microsoft-Windows-GroupPolicy/Operational/4001: Starting user logon Policy processing
This event indicates that the Group Policy for a specific user has been updated due to the user having logged in. This is as opposed to [Microsoft-Windows-GroupPolicy/Operational/4005: Starting manual processing of policy for user](/group-policy/evtx-4005-user-manual-gpo-processing-start.md), which is a user GPO processing started manually or periodically.

### Analysis Value
 - [x] Network - Evidence of Network Activity

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista


## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx`

## Artifact Interpretation

| XML Path                              | Interpretation  |
| ------------------------------------- | --------------- |
| System/Correlation ActivityID            | The ActivityID for this GPO update. This can be used to filter/correlate other events relating to this activity in both the System event log as well as the Group Policy Operational log. |
| EventData/PrincipalSamName            | The SAM name for the user account for which the GPO update was started. |

In the event that new User Group Policy Objects were found for the user in question, [System/1503: The Group Policy settings for the user were processed successfully](/group-policy/evtx-1503-user-gpo-success.md) will be generated with the same `System/Correlation ActivityID `.

If new User Group Policy Objects were found, [Microsoft-Windows-GroupPolicy/Operational/5312: List of applicable Group Policy objects](/group-policy/evtx-5312-list-of-gpo.md) will be generated with the same `System/Correlation ActivityID `, providing a list of all the applicable GPOs.

## Example
```
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" /> 
  <EventID>4001</EventID> 
  <Version>1</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>1</Opcode> 
  <Keywords>0x[PII_REDACTED]000000</Keywords> 
  <TimeCreated SystemTime="2024-04-22T03:19:16.5400805Z" /> 
  <EventRecordID>34</EventRecordID> 
  <Correlation ActivityID="{13a6c2c7-a1ac-41e6-8e29-3a4bccb76ddf}" /> 
  <Execution ProcessID="2832" ThreadID="6072" /> 
  <Channel>Microsoft-Windows-GroupPolicy/Operational</Channel> 
  <Computer>DESKTOP-88KIKM6</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="PolicyActivityId">{13a6c2c7-a1ac-41e6-8e29-3a4bccb76ddf}</Data> 
  <Data Name="PrincipalSamName">DESKTOP-88KIKM6\defaultuser0</Data> 
  <Data Name="IsMachine">0</Data> 
  <Data Name="IsDomainJoined">false</Data> 
  <Data Name="IsBackgroundProcessing">false</Data> 
  <Data Name="IsAsyncProcessing">false</Data> 
  <Data Name="IsServiceRestart">false</Data> 
  <Data Name="ReasonForSyncProcessing">1</Data> 
  </EventData>
  </Event>
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19045 Build 19045</sub></sup>
Windows Forensic Artifact Reference: evtx 1502 computer gpo success

# System/1502: The Group Policy settings for the computer were processed successfully
This event indicates that Group Policy Object processing for a specific computer was completed, and that new Group Policy Objects were found and applied to the computer. It is the result of either:

 - A manual/scheduled user GPO update: [Microsoft-Windows-GroupPolicy/Operational/4004: Starting manual processing of policy for computer](/group-policy/evtx-4004-computer-manual-gpo-processing-start.md)
 - A user logon GPO update: [Microsoft-Windows-GroupPolicy/Operational/4000: Starting computer boot policy processing](/group-policy/evtx-4000-computer-boot-gpo-processing-start.md)

### Analysis Value
 - [x] Network - Evidence of Network Activity

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista


## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\System.evtx`

## Artifact Interpretation

| XML Path                              | Interpretation  |
| ------------------------------------- | --------------- |
| System/Correlation ActivityID            | The ActivityID for this GPO update. This can be used to filter/correlate other events relating to this activity in both the System event log as well as the Group Policy Operational log. |
| EventData/NumberOfGroupPolicyObjects            | How many GPOs were processed. |

If new Comptuer Group Policy Objects were found, [Microsoft-Windows-GroupPolicy/Operational/5312: List of applicable Group Policy objects](/group-policy/evtx-5312-list-of-gpo.md) will be generated with the same `System/Correlation ActivityID `, providing a list of all the applicable GPOs.

## Example
```
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" /> 
  <EventID>1502</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>1</Opcode> 
  <Keywords>0x[PII_REDACTED]000000</Keywords> 
  <TimeCreated SystemTime="2024-04-22T19:48:03.3504551Z" /> 
  <EventRecordID>563</EventRecordID> 
  <Correlation ActivityID="{d739f467-3600-41b9-8b95-3cef52425544}" /> 
  <Execution ProcessID="13044" ThreadID="4444" /> 
  <Channel>System</Channel> 
  <Computer>DESKTOP-88KIKM6.example.lan</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="SupportInfo1">1</Data> 
  <Data Name="SupportInfo2">4430</Data> 
  <Data Name="ProcessingMode">0</Data> 
  <Data Name="ProcessingTimeInMilliseconds">1328</Data> 
  <Data Name="DCName">\\nndc01.example.lan</Data> 
  <Data Name="NumberOfGroupPolicyObjects">4</Data> 
  </EventData>
  </Event>
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19045 Build 19045</sub></sup>
Windows Forensic Artifact Reference: sam hive

# SAM Hive
The SAM hive contains a wealth of information that can be used to profile an endpoint's accounts. For domain-joined endpoints, the SAM hive will be present on the domain controller. Non-domain joined endpoints will have a resident SAM hive. 

### Behavioral Indications
 - [x] Behavioral - Persistence (TA0003)

### Analysis Value
 - [x] Account - Creation Time
 - [x] Account - Group Membership
 - [x] Account - Last Login
 - [x] Account - Relative Identifier (RID)

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP

## Artifact Location(s)
- File: `%SystemRoot%\System32\config\SAM`

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
Within the SAM hive, the registry key located at `SAM\Domains\Accounts\Users` will contain the following values for each account:

 - Relative Identifier (RID)
 - CreatedOn time (Time the account was created)
 - Logon Count
 - Username
 - Password reset questions
 - Password Hints
 - Last Login Time
 - Last Failed Login Time
 - Last Password Change Time

> [!NOTE]
> If the account in question is authenticating using Microsoft Live, the Logon Count will be 0.
Windows Forensic Artifact Reference: profile list key

# ProfileList Registry Key
The ProfileList Registry Key is a registry key that contains subkeys named by user SIDs present on the endpoint. Within each SID subkey are values that can assist in matching SIDs to usernames during dead-disk forensics. 

### Analysis Value
 - [x] Account - Security Identifier (SID)
 - [x] Account - Username

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\{USER_SID}`

🔌 Offline system:
- File: `%SystemRoot%\System32\Config\SOFTWARE`
- Key: `SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\{USER_SID}`

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
The value `ProfileImagePath` of type `REG_EXPAND_SZ` contains the full path to a user's home directory, which will typically be named after the user. 

The value `Sid` of type `REG_BINARY` will contain the binary representation of the user's SID. 

## Example
The following example shows how the username `user` maps to the SID `S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1001`.
```
PS> Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1001" -Name *

ProfileImagePath                        : C:\Users\user1
Flags                                   : 0
FullProfile                             : 1
State                                   : 256
Sid                                     : {1, 5, 0, 0...}
LocalProfileLoadTimeLow                 :[PII_REDACTED]
LocalProfileLoadTimeHigh                : 31041204
ProfileAttemptedProfileDownloadTimeLow  : 0
ProfileAttemptedProfileDownloadTimeHigh : 0
ProfileLoadTimeLow                      : 0
ProfileLoadTimeHigh                     : 0
LocalProfileUnloadTimeLow               :[PII_REDACTED]
LocalProfileUnloadTimeHigh              : 31029421
RunLogonScriptSync                      : 0
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: group membership key

# Group Membership Registry Key
The Group Membership Registry Key is a registry key that stores information about all the groups a user is a part of. It is located in the Windows registry under a user's profile and contains the group security identifiers (SIDs) and a count of how many groups a user is joined to.

### Analysis Value
 - [x] Account - Group Membership
 - [x] Endpoint - Enumeration

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP

## Artifact Location(s)
This registry key resides in the NTUSER.DAT file, and on a live system is loaded into HKEY_USERS.

🔋 Live System:
- `HKEY_USERS\{USER_SID}\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership`

🔌 Offline system:
- File: `%UserProfile%\NTUSER.DAT`
- Key: `SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership`

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
Two distinct values are present within this key. The `Count` REG_DWORD value is a count of how many groups the user is a member of. 

The corresponding Group Security Identifiers (SIDs) are enumerated as REG_SZ values of the format `GroupX`. 

## Example
```
PS> New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS
PS> > Get-ItemProperty -Path "HKU:\S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership" -Name *

Group0       : S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-513
Group1       : S-1-1-0
Group2       : S-1-5-114
Group3       : S-1-5-32-544
Group4       : S-1-5-32-559
Group5       : S-1-5-32-545
Group6       : S-1-5-4
Group7       : S-1-2-1
Group8       : S-1-5-11
Group9       : S-1-5-15
Group10      : S-1-5-113
Group11      : S-1-2-0
Group12      : S-1-5-64-10
Group13      : S-1-16-12288
Count        : 14
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: evtx 4720 account created

# Security/4720: A user account was created
This event, logged to the Security channel, indicates a new user account was created on the endpoint.

> [!NOTE]
> In windows XP, the corresponding Event ID is `624`.

### Behavioral Indications
 - [x] Behavioral - Persistence (TA0003)

### Analysis Value
 - [x] Account - Creation Time
 - [x] Account - Logon ID
 - [x] Account - Security Identifier (SID)

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista

## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Security.evtx`

## Artifact Interpretation
The following fields may be interpreted from this artifact:

| Field Name | Interpretation |
| - | - |
| Subject / Security ID | SID of account that created the new account |
| Subject / Account Name | Account name of account that created the new account |
| Subject / Logon ID | [Logon ID](/README.md/#account---logon-id) of session for account that created the new account |
| New Account / Security ID | SID of the new account |
| New Account / Account Name | Name of the new account |

> [!NOTE]
> The SID may be translated by event viewer. To view the raw SID, look at the event's XML data, which has the following fields available:

When parsing the event's XML data:

| XML Path | Interpretation |
| - | - |
| EventData/TargetUserName | New account name |
| EventData/TargetSid | New account SID |
| EventData/SubjectUserSid | SID of account that created the new account |
| EventData/SubjectUserName | Account name of account that created the new account |
| EventData/SubjectLogonId | [Logon ID](/README.md/#account---logon-id) of session for account that created the new account |
Windows Forensic Artifact Reference: evtx 4625 failed logon

# Security/4625: An account failed to log on 
This logon event indicates an account has failed to authenticate to the endpoint. It is logged on the **destination** endpoint. It closely mirrors the information logged for the event [4624: An account was successfully logged on](/account/evtx-4624-successful-logon.md).

> [!NOTE]
> This event is a **Logon Event**, meaning it is logged on the system that is being authenticated to. 

### Behavioral Indications
 - [x] Behavioral - Lateral Movement (TA0008)

### Analysis Value
 - [x] Account - Login History
 - [x] Account - Security Identifier (SID)
 - [x] Network Activity - Source Identification

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP

## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Security.evtx`

## Artifact Interpretation
The following fields may be interpreted from this artifact:

| Field Name | Interpretation |
| - | - |
| Logon Type | Logon type. See [Logon Types](#logon-types) |
| Account For Which Logon Failed / Security ID | SID of account that authenticated |
| Account For Which Logon Failed / Account Name | Name of account that authenticated |
| Network Information / Source Network Address | IP address of source endpoint |

> [!NOTE]
> The SID may be translated by event viewer. To view the raw SID, look at the event's XML data, which has the following fields available:

| XML Field Name | Interpretation |
| - | - |
| EventData/LogonType | Logon type. See [Logon Types](#logon-types) |
| EventData/TargetUserSid | SID of account that authenticated |
| EventData/TargetUserName | Name of account that authenticated |
| EventData/IpAddress | IP address of source endpoint |

### Logon Types
The following logon types are commonly seen:

| Logon Type | Description |
| - | - |
| 2 | **Interactive** (user loggong on through screen or virtual console) |
| 3 | **Network** (RDP with NLA enabled) |
| 7 | **Unlock** (RDP reconnects or interactive unlocking) |
| 9 | **Explicit** credentials (`runas`) |
| 10 | **Remote** Interactive (RDP with NLA diasbled) |
Windows Forensic Artifact Reference: evtx 4648 explicit credentials

# Security/4648: Logon using explicit credentials
This event, logged to the Security channel, indicates a logon was completed using explicit credentials. Explicit credentials refers to credentials that are not currently active and have been explicitly selected by an attacker. It is logged on the **source** system and may indicate lateral movement tactics such as the use of `runas` or access to remote file shares.

> [!NOTE]
> In windows XP, the corresponding Event ID is `552`.

### Behavioral Indications
 - [x] Behavioral - Lateral Movement (TA0008)

### Analysis Value
 - [x] Account - Login History
 - [x] Account - Logon ID
 - [x] Account - Security Identifier (SID)
 - [x] Network Activity - Destination Identification

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP

## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Security.evtx`

## Artifact Interpretation
The following fields may be interpreted from this artifact:

| Field Name | Interpretation |
| - | - |
| Subject / Security ID | SID of account that used the explicit credentials |
| Subject / Account Name | Name of account that used the explicit credentials |
| Subject / Logon ID | [Logon ID](/README.md/#account---logon-id) of session for account that used the explicit credentials |
| Account Whose Credentials Were Used / Account Name | Account name for the explicit credentials |
| Target Server / Target Server Name | The name of the **destination** endpoint the credentials were used on |
| Process Information / Process ID | Hex PID of the process that used the explicit credentials |
| Process Information / Process Name | The command line of the process that used the explicit credentials |
| Network Information / Network Address | IP address of **source** endpoint |

> [!NOTE]
> The SID may be translated by event viewer. To view the raw SID, look at the event's XML data, which has the following fields available:

This event may be correlated with events found on the destination endpoint, such as event [4624: An account was successfully logged on](/account/evtx-4624-successful-logon.md). In the case of runas activity, a 4624 event will be registered with Logon type 9.