4672 Security log · Logon/Logoff high severity medium volume

Windows Event ID 4672 — Special privileges assigned to new logon

An account logged on with sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeBackupPrivilege, SeRestorePrivilege). Only fires for non-built-in Administrators group members.

Why event 4672 matters

SeDebugPrivilege = LSASS dumping capability (Mimikatz requires it). SeTcbPrivilege = token forgery. SeCreateTokenPrivilege = arbitrary token creation. SeLoadDriverPrivilege = kernel driver load (rootkits). Any non-expected account receiving these warrants immediate review.

How to detect it

Alert: 4672 for accounts NOT in a pre-approved admin allowlist. Alert: SeDebugPrivilege or SeTcbPrivilege for non-SYSTEM accounts. Build baseline of expected admin accounts with these privileges.

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameSubjectDomainNamePrivilegeList

MITRE ATT&CK mapping

Tactic Technique
Privilege Escalation Access Token Manipulation (T1134)
Credential Access LSASS Memory (T1003.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Special Privilege Logon — Non-System Account
status: experimental
description: Special privileges assigned to an account not expected to hold them
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4672
    filter_builtin:
        SubjectUserName|endswith:
            - '$'
            - 'SYSTEM'
            - 'LOCAL SERVICE'
            - 'NETWORK SERVICE'
    condition: selection and not filter_builtin
falsepositives:
    - Legitimate admin accounts — build allowlist
level: medium
tags:
    - attack.privilege_escalation
    - attack.t1134
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4672   // Special privileges assigned to new logon
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName, PrivilegeList
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4672
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Special privileges assigned to new logon — add EventData fields: SubjectUserName, SubjectDomainName, PrivilegeList`
Hunt event 4672 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4672?

Special privileges assigned to new logon. An account logged on with sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeBackupPrivilege, SeRestorePrivilege). Only fires for non-built-in Administrators group members.

Which log records event 4672?

Event 4672 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4672?

Event 4672 is associated with: Access Token Manipulation (T1134), LSASS Memory (T1003.001).

How do you detect activity around event 4672?

Alert: 4672 for accounts NOT in a pre-approved admin allowlist. Alert: SeDebugPrivilege or SeTcbPrivilege for non-SYSTEM accounts. Build baseline of expected admin accounts with these privileges.