An account logged on with sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeBackupPrivilege, SeRestorePrivilege). Only fires for non-built-in Administrators group members.
SeDebugPrivilege = LSASS dumping capability (Mimikatz requires it). SeTcbPrivilege = token forgery. SeCreateTokenPrivilege = arbitrary token creation. SeLoadDriverPrivilege = kernel driver load (rootkits). Any non-expected account receiving these warrants immediate review.
Alert: 4672 for accounts NOT in a pre-approved admin allowlist. Alert: SeDebugPrivilege or SeTcbPrivilege for non-SYSTEM accounts. Build baseline of expected admin accounts with these privileges.
SubjectUserNameSubjectDomainNamePrivilegeList | Tactic | Technique |
|---|---|
| Privilege Escalation | Access Token Manipulation (T1134) |
| Credential Access | LSASS Memory (T1003.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Special Privilege Logon — Non-System Account
status: experimental
description: Special privileges assigned to an account not expected to hold them
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4672
filter_builtin:
SubjectUserName|endswith:
- '$'
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: selection and not filter_builtin
falsepositives:
- Legitimate admin accounts — build allowlist
level: medium
tags:
- attack.privilege_escalation
- attack.t1134
SecurityEvent
| where EventID == 4672 // Special privileges assigned to new logon
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName, PrivilegeList
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4672
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Special privileges assigned to new logon — add EventData fields: SubjectUserName, SubjectDomainName, PrivilegeList`
Special privileges assigned to new logon. An account logged on with sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeBackupPrivilege, SeRestorePrivilege). Only fires for non-built-in Administrators group members.
Event 4672 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Event 4672 is associated with: Access Token Manipulation (T1134), LSASS Memory (T1003.001).
Alert: 4672 for accounts NOT in a pre-approved admin allowlist. Alert: SeDebugPrivilege or SeTcbPrivilege for non-SYSTEM accounts. Build baseline of expected admin accounts with these privileges.