A logon right was removed from an account.
Removing logon rights from security accounts as sabotage. Removing SeServiceLogonRight from AV service accounts prevents service restart.
Alert: logon rights removed from security tool service accounts.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4718 // System security access was removed from an account
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4718
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# System security access was removed from an account — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`System security access was removed from an account. A logon right was removed from an account.
Event 4718 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Policy Change' subcategory (Success and/or Failure).
Alert: logon rights removed from security tool service accounts.