Few users reported that winlog.event_data.NewUACList shows incorrect translation for the User Access Control values and there is a discrepancy with what is generated from Powershell too.

From the official documentation the values should be https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380

• x-pack/winlogbeat/modules/security: fix UAC attribute bit table #37009
• system,windows: fix UAC attribute bit table integrations#8361