4673 Security log · Privilege Use medium severity high volume

Windows Event ID 4673 — A privileged service was called

A privileged service or operation was called. PrivilegeList shows which privileges were used. SubjectUserName and ProcessName indicate who and what.

Why event 4673 matters

SeDebugPrivilege use for LSASS access (credential dumping). SeTcbPrivilege for token manipulation. SeBackupPrivilege for shadow copy access and SAM hive backup. SeRestorePrivilege for registry hive manipulation.

How to detect it

Alert: SeDebugPrivilege used by processes other than debuggers or AV. Alert: SeBackupPrivilege used by processes in user temp directories. High volume — focus on specific privilege+process combinations.

Log source
Security
Advanced Audit Policy — enable the 'Privilege Use' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameProcessNamePrivilegeListService

MITRE ATT&CK mapping

Tactic Technique
Credential Access OS Credential Dumping (T1003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4673   // A privileged service was called
| project TimeGenerated, Computer, SubjectUserName, ProcessName, PrivilegeList, Service
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4673
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A privileged service was called — add EventData fields: SubjectUserName, ProcessName, PrivilegeList, Service`
Hunt event 4673 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Privilege Use events

4674 An operation was attempted on a privileged object 4675 SIDs were filtered

Frequently asked questions

What is Windows Event ID 4673?

A privileged service was called. A privileged service or operation was called. PrivilegeList shows which privileges were used. SubjectUserName and ProcessName indicate who and what.

Which log records event 4673?

Event 4673 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Privilege Use' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4673?

Event 4673 is associated with: OS Credential Dumping (T1003).

How do you detect activity around event 4673?

Alert: SeDebugPrivilege used by processes other than debuggers or AV. Alert: SeBackupPrivilege used by processes in user temp directories. High volume — focus on specific privilege+process combinations.