Data Source: Windows Event Log Security 4702

 1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4702</EventID><Version>1</Version><Level>0</Level><Task>12804</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2023-04-06T18:45:58.819483000Z'/><EventRecordID>170571</EventRecordID><Correlation ActivityID='{4051c54d-67e6-0003-68c5-5140e667d901}'/><Execution ProcessID='624' ThreadID='3740'/><Channel>Security</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-DC$</Data><Data Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='TaskName'>\Microsoft\Windows\WindowsUpdate\Scheduled Start</Data><Data Name='TaskContentNew'>&lt;?xml version="1.0" encoding="UTF-16"?&gt;&lt;Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"&gt;
 2&lt;RegistrationInfo&gt;
 3    &lt;Source&gt;Microsoft Corporation.&lt;/Source&gt;
 4    &lt;Author&gt;Microsoft Corporation.&lt;/Author&gt;
 5    &lt;Description&gt;This task is used to start the Windows Update service when needed to perform scheduled operations such as scans.&lt;/Description&gt;
 6    &lt;URI&gt;\Microsoft\Windows\WindowsUpdate\Scheduled Start&lt;/URI&gt;
 7    &lt;SecurityDescriptor&gt;D:(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FA;;;BA)&lt;/SecurityDescriptor&gt;
 8&lt;/RegistrationInfo&gt;
 9&lt;Triggers&gt;
10    &lt;TimeTrigger&gt;
11    &lt;StartBoundary&gt;2023-04-07T17:43:11Z&lt;/StartBoundary&gt;
12    &lt;Enabled&gt;true&lt;/Enabled&gt;
13    &lt;RandomDelay&gt;PT1M&lt;/RandomDelay&gt;
14    &lt;/TimeTrigger&gt;
15    &lt;SessionStateChangeTrigger&gt;
16    &lt;Enabled&gt;false&lt;/Enabled&gt;
17    &lt;StateChange&gt;ConsoleDisconnect&lt;/StateChange&gt;
18    &lt;/SessionStateChangeTrigger&gt;
19    &lt;SessionStateChangeTrigger&gt;
20    &lt;Enabled&gt;false&lt;/Enabled&gt;
21    &lt;StateChange&gt;RemoteDisconnect&lt;/StateChange&gt;
22    &lt;/SessionStateChangeTrigger&gt;
23    &lt;WnfStateChangeTrigger&gt;
24    &lt;Enabled&gt;false&lt;/Enabled&gt;
25    &lt;StateName&gt;7508BCA3380C960C&lt;/StateName&gt;
26    &lt;Data&gt;01&lt;/Data&gt;
27    &lt;DataOffset&gt;0&lt;/DataOffset&gt;
28    &lt;/WnfStateChangeTrigger&gt;
29&lt;/Triggers&gt;
30&lt;Principals&gt;
31    &lt;Principal id="LocalSystem"&gt;
32    &lt;RunLevel&gt;LeastPrivilege&lt;/RunLevel&gt;
33    &lt;UserId&gt;NT AUTHORITY\SYSTEM&lt;/UserId&gt;
34    &lt;/Principal&gt;
35&lt;/Principals&gt;
36&lt;Settings&gt;
37    &lt;MultipleInstancesPolicy&gt;IgnoreNew&lt;/MultipleInstancesPolicy&gt;
38    &lt;DisallowStartIfOnBatteries&gt;false&lt;/DisallowStartIfOnBatteries&gt;
39    &lt;StopIfGoingOnBatteries&gt;false&lt;/StopIfGoingOnBatteries&gt;
40    &lt;AllowHardTerminate&gt;true&lt;/AllowHardTerminate&gt;
41    &lt;StartWhenAvailable&gt;true&lt;/StartWhenAvailable&gt;
42    &lt;RunOnlyIfNetworkAvailable&gt;false&lt;/RunOnlyIfNetworkAvailable&gt;
43    &lt;IdleSettings&gt;
44    &lt;Duration&gt;PT10M&lt;/Duration&gt;
45    &lt;WaitTimeout&gt;PT1H&lt;/WaitTimeout&gt;
46    &lt;StopOnIdleEnd&gt;true&lt;/StopOnIdleEnd&gt;
47    &lt;RestartOnIdle&gt;false&lt;/RestartOnIdle&gt;
48    &lt;/IdleSettings&gt;
49    &lt;AllowStartOnDemand&gt;false&lt;/AllowStartOnDemand&gt;
50    &lt;Enabled&gt;true&lt;/Enabled&gt;
51    &lt;Hidden&gt;false&lt;/Hidden&gt;
52    &lt;RunOnlyIfIdle&gt;false&lt;/RunOnlyIfIdle&gt;
53    &lt;DisallowStartOnRemoteAppSession&gt;false&lt;/DisallowStartOnRemoteAppSession&gt;
54    &lt;UseUnifiedSchedulingEngine&gt;true&lt;/UseUnifiedSchedulingEngine&gt;
55    &lt;WakeToRun&gt;false&lt;/WakeToRun&gt;
56    &lt;ExecutionTimeLimit&gt;PT72H&lt;/ExecutionTimeLimit&gt;
57    &lt;Priority&gt;7&lt;/Priority&gt;
58&lt;/Settings&gt;
59&lt;Actions Context="LocalSystem"&gt;
60    &lt;Exec&gt;
61    &lt;Command&gt;C:\Windows\system32\sc.exe&lt;/Command&gt;
62    &lt;Arguments&gt;start wuauserv&lt;/Arguments&gt;
63    &lt;/Exec&gt;
64&lt;/Actions&gt;
65&lt;/Task&gt;</Data><Data Name='ClientProcessStartKey'>165225811329162977</Data><Data Name='ClientProcessId'>2584</Data><Data Name='ParentProcessId'>604</Data><Data Name='RpcCallClientLocality'>0</Data><Data Name='FQDN'>ar-win-dc.attackrange.local</Data></EventData></Event>