Event ID 1074 —

{
  "system": {
    "provider": "User32",
    "guid": "{b0aa8734-56f7-41cc-b2f4-de228e98b946}",
    "event_source_name": "User32",
    "event_id": 1074,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9259400833873739776,
    "time_created": "2023-11-06T06:23:40.035258+00:00",
    "event_record_id": 1620,
    "correlation": {},
    "execution": {
      "process_id": 580,
      "thread_id": 596
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "param1": "C:\\Windows\\system32\\winlogon.exe (WINDEVEVAL)",
    "param2": "WIN-91F0RT9CFIN",
    "param3": "Operating System: Upgrade (Planned)",
    "param4": "0x80020003",
    "param5": "restart",
    "param6": "",
    "param7": "NT AUTHORITY\\SYSTEM"
  },
  "message": ""
}