Author: Barrie Hill barrie0482@gmail.com
Description: The screen saver was dismissed
EventId: 4803
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: PayloadData1
    PropertyValue: "Target: %TargetDomainName%\\%TargetUserName%"
    Values:
      -
        Name: TargetDomainName
        Value: "/Event/EventData/Data[@Name=\"TargetDomainName\"]"
      -
        Name: TargetUserName
        Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"

# Documentation:
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4803
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4803
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# Example Event Data:
# <Event>
#   <System>
#       <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
#       <EventID>4803</EventID>
#       <Version>0</Version>
#       <Level>0</Level>
#       <Task>12551</Task>
#       <Opcode>0</Opcode>
#       <Keywords>0x8020000000000000</Keywords>
#       <TimeCreated SystemTime="2019-04-28T08:15:41.216065200Z" />
#       <EventRecordID>91100</EventRecordID>
#       <Correlation ActivityID="{32dfcbe2-f43e-0002-74cc-df323ef4d401}" />
#       <Execution ProcessID="940" ThreadID="17780" />
#       <Channel>Security</Channel>
#       <Computer>pooh</Computer>
#       <Security />
# </System>
#   <EventData>
#       <Data Name="TargetUserSid">S-1-5-21-1987904521-730768085-2188298509-1001</Data>
#       <Data Name="TargetUserName">baz</Data>
#       <Data Name="TargetDomainName">POOH</Data>
#       <Data Name="TargetLogonId">0x1887d9f9</Data>
#       <Data Name="SessionId">19</Data>
#   </EventData>
# </Event>
