4674 Security log · Privilege Use medium severity medium volume

Windows Event ID 4674 — An operation was attempted on a privileged object

An operation was attempted on a privileged object using special privileges. ObjectName and PrivilegeList are key.

Why event 4674 matters

Access to sensitive objects (SAM, LSASS) using elevated privileges. Correlate with 4656 and 4663 for full access picture.

How to detect it

Alert: operation on SAM or LSASS objects with elevated privileges. Correlate with 4656 for context.

Log source
Security
Advanced Audit Policy — enable the 'Privilege Use' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access OS Credential Dumping (T1003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4674   // An operation was attempted on a privileged object
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4674
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An operation was attempted on a privileged object — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4674 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Privilege Use events

4673 A privileged service was called 4675 SIDs were filtered

Frequently asked questions

What is Windows Event ID 4674?

An operation was attempted on a privileged object. An operation was attempted on a privileged object using special privileges. ObjectName and PrivilegeList are key.

Which log records event 4674?

Event 4674 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Privilege Use' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4674?

Event 4674 is associated with: OS Credential Dumping (T1003).

How do you detect activity around event 4674?

Alert: operation on SAM or LSASS objects with elevated privileges. Correlate with 4656 for context.