A token privilege was enabled or disabled for a process. Lists which privileges changed.
Token privilege adjustment is used to enable necessary privileges for attacks. Enabling SeDebugPrivilege or SeTcbPrivilege signals credential dumping or token manipulation.
Alert: SeDebugPrivilege or SeTcbPrivilege enabled by non-expected processes.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Privilege Escalation | Access Token Manipulation (T1134) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4703 // A token right was adjusted
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4703
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A token right was adjusted — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A token right was adjusted. A token privilege was enabled or disabled for a process. Lists which privileges changed.
Event 4703 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Policy Change' subcategory (Success and/or Failure).
Event 4703 is associated with: Access Token Manipulation (T1134).
Alert: SeDebugPrivilege or SeTcbPrivilege enabled by non-expected processes.