Windows Event ID 4673 – Security: Sensitive Privilege Use

Start by examining the specific Event ID 4673 entries to understand the privilege usage context:

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4673 using the filter option in the Actions pane
3. Double-click on recent 4673 events to examine details
4. Note the following key fields in the event description:
   • Subject: User account and SID performing the action
   • Process Information: Process name and ID using the privilege
   • Privilege: Specific privilege being exercised
   • Object: Target object if applicable
5. Cross-reference the timestamp with other security events for context

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Use PowerShell to analyze privilege usage trends and identify anomalies:

1. Extract and group privilege usage by user account:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673; StartTime=(Get-Date).AddDays(-7)}
$Events | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        User = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
        ProcessName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
        Privilege = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
    }
} | Group-Object User, Privilege | Sort-Object Count -Descending

2. Identify unusual privilege combinations or high-frequency usage:

# Find processes using multiple sensitive privileges
$PrivilegeUsage = $Events | Group-Object ProcessName | Where-Object {$_.Count -gt 10}
$PrivilegeUsage | Select-Object Name, Count | Format-Table

3. Check for privilege usage outside business hours:

$Events | Where-Object {$_.TimeCreated.Hour -lt 8 -or $_.TimeCreated.Hour -gt 18} | Select-Object TimeCreated, User, ProcessName

Ensure proper audit policy configuration to capture all sensitive privilege usage:

1. Open Local Group Policy Editor (gpedit.msc) or Group Policy Management Console
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Privilege Use and configure the following policies:
   • Audit Sensitive Privilege Use: Enable for Success and Failure
   • Audit Non Sensitive Privilege Use: Enable for Failure (optional)
4. Apply the policy and run gpupdate /force to refresh settings

Verify audit policy configuration using PowerShell:

# Check current audit policy settings
auditpol /get /category:"Privilege Use"

# Enable sensitive privilege use auditing
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable

5. Configure Security log size to accommodate increased event volume:

# Increase Security log maximum size to 100MB
wevtutil sl Security /ms:104857600

# Set log retention policy
wevtutil sl Security /rt:false

Registry path for manual configuration: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security

Focus investigation on high-risk privilege usage patterns that indicate potential security threats:

1. Monitor SeDebugPrivilege usage for process injection attempts:

# Find SeDebugPrivilege usage by non-system processes
$DebugEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673} | Where-Object {
    $_.Message -like '*SeDebugPrivilege*' -and $_.Message -notlike '*SYSTEM*'
}
$DebugEvents | Select-Object TimeCreated, @{n='User';e={($_.Message -split '\n' | Select-String 'Account Name:')[0] -replace '.*Account Name:\s*',''}}

2. Check for SeBackupPrivilege abuse in unauthorized file access:

# Correlate backup privilege usage with file access events
$BackupEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673} | Where-Object {$_.Message -like '*SeBackupPrivilege*'}
$FileAccess = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656,4658} -MaxEvents 1000

# Find temporal correlation between backup privilege and sensitive file access
$BackupEvents | ForEach-Object {
    $BackupTime = $_.TimeCreated
    $RelatedAccess = $FileAccess | Where-Object {
        [Math]::Abs(($_.TimeCreated - $BackupTime).TotalMinutes) -lt 5
    }
    if ($RelatedAccess) {
        Write-Host "Potential backup privilege abuse at $BackupTime"
    }
}

3. Analyze SeLoadDriverPrivilege for malicious driver loading:

# Monitor driver loading privilege usage
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673} | Where-Object {
    $_.Message -like '*SeLoadDriverPrivilege*'
} | Select-Object TimeCreated, @{n='ProcessName';e={($_.Message -split '\n' | Select-String 'Process Name:')[0] -replace '.*Process Name:\s*',''}}

4. Cross-reference with Windows Defender and system integrity events:

# Check for correlation with security software alerts
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'} -MaxEvents 100 | Where-Object {
    $_.TimeCreated -gt (Get-Date).AddHours(-24)
}

Set up proactive monitoring for Event ID 4673 to detect privilege abuse in real-time:

1. Create a scheduled task to monitor high-risk privilege usage:

# Create monitoring script
$MonitorScript = @'
$SensitivePrivileges = @('SeDebugPrivilege', 'SeLoadDriverPrivilege', 'SeTcbPrivilege')
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673; StartTime=(Get-Date).AddMinutes(-15)}

foreach ($Event in $Events) {
    $xml = [xml]$Event.ToXml()
    $Privilege = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
    $User = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
    $Process = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
    
    if ($Privilege -in $SensitivePrivileges -and $User -ne 'SYSTEM') {
        Write-EventLog -LogName Application -Source 'PrivilegeMonitor' -EventId 1001 -EntryType Warning -Message "Sensitive privilege $Privilege used by $User in process $Process"
    }
}
'@

# Save script and create scheduled task
$MonitorScript | Out-File -FilePath 'C:\Scripts\PrivilegeMonitor.ps1'
Register-ScheduledTask -TaskName 'PrivilegeMonitor' -Trigger (New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -Once -At (Get-Date)) -Action (New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\PrivilegeMonitor.ps1')

2. Configure Windows Event Forwarding for centralized monitoring:

# Configure WinRM for event forwarding
winrm quickconfig -q
wecutil qc /q

# Create subscription for Event ID 4673
$SubscriptionXML = @'

    PrivilegeUseMonitoring
    SourceInitiated
    Monitor sensitive privilege usage across domain
    true
    http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog
    Normal
    
            
                *[System[(EventID=4673)]]
            
        
    ]]>

'@

$SubscriptionXML | Out-File -FilePath 'C:\Temp\PrivilegeSubscription.xml'
wecutil cs 'C:\Temp\PrivilegeSubscription.xml'

3. Set up email alerts for critical privilege usage:

# Create alert script with email notification
$AlertScript = @'
param($EventID, $User, $Privilege, $Process)

$SMTPServer = "mail.company.com"
$From = "security-alerts@company.com"
$To = "security-team@company.com"
$Subject = "ALERT: Sensitive Privilege Usage Detected"
$Body = "Event ID: $EventID`nUser: $User`nPrivilege: $Privilege`nProcess: $Process`nTime: $(Get-Date)"

Send-MailMessage -SmtpServer $SMTPServer -From $From -To $To -Subject $Subject -Body $Body
'@

$AlertScript | Out-File -FilePath 'C:\Scripts\PrivilegeAlert.ps1'