Parsing the AccessList field for example for the AD 4656 events gives, with the python-evtx, a list of codes like
%%1537, %%1538, %%1539, %%1540, %%1541, %%4480 ...
while the windows evtx viewer shows a list with human readable codes like below
DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE ...
Any idea how i can remap to human readable format?
Thanks
Parsing the AccessList field for example for the AD 4656 events gives, with the python-evtx, a list of codes like %%1537, %%1538, %%1539, %%1540, %%1541, %%4480 ... while the windows evtx viewer shows a list with human readable codes like below DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE ...
Any idea how i can remap to human readable format? Thanks