Author: Andrew Rathbun
Description: An account was mapped for logon
EventId: 4774
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: PayloadData1
    PropertyValue: "Target: %TargetUserName%"
    Values:
      -
        Name: TargetUserName
        Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"

# Documentation:
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4774
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4774
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
# Per Microsoft, success events do not generate.
# This map is in place in case this event does come across in logs so the Map Description field will be populated.
#
# Example Event Data:
# N/A
