← cd ~/events
// events/4672 · Sign-in
Event ID 4672Special privileges assigned to new logon
A new logon was given one or more sensitive privileges, such as SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege or SeTakeOwnershipPrivilege. In practice it marks an administrative logon.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Sign-in |
What to check
Alert when the account is not SYSTEM, NETWORK SERVICE, LOCAL SERVICE or an expected admin. Search the Privileges field for rights that only a few accounts should hold.
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4672 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4672
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Sign-in events
- Event ID 4624: An account was successfully logged on
- Event ID 4625: An account failed to log on
- Event ID 4634: An account was logged off
- Event ID 4647: User initiated logoff
- Event ID 4648: A logon was attempted using explicit credentials
- Event ID 4776: The computer attempted to validate the credentials for an account