Windows Event ID 4964 — Special groups have been assigned to a new logon — SecOps Tools

Why event 4964 matters

Fires when a high-privilege group member logs on (if Special Groups policy is configured). Any compromised Domain Admin account logon will trigger this.

How to detect it

Alert on every occurrence. Verify AccountName, time of day, and source IP. Particularly valuable as a scoped alternative to 4672 noise.

Log source

Security

Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Privilege Escalation	Valid Accounts: Domain Accounts (T1078.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: Special Group Logon
status: experimental
description: Logon by member of configured special groups
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4964
    condition: selection
falsepositives:
    - Authorized admin logons
level: high
tags:
    - attack.privilege_escalation
    - attack.t1078.002

Sentinel / Defender KQL

SecurityEvent
| where EventID == 4964   // Special groups have been assigned to a new logon
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=4964
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Special groups have been assigned to a new logon — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4964 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked

Frequently asked questions

What is Windows Event ID 4964?

Special groups have been assigned to a new logon. Account is a member of Special Groups as defined in audit policy. Only fires when Special Groups auditing is configured.

Which log records event 4964?

Event 4964 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4964?

Event 4964 is associated with: Valid Accounts: Domain Accounts (T1078.002).

How do you detect activity around event 4964?

Alert on every occurrence. Verify AccountName, time of day, and source IP. Particularly valuable as a scoped alternative to 4672 noise.