Windows Event ID 4674 – Security: Privileged Object Operation Attempted

Start by examining the specific Event ID 4674 entries to understand what privileges are being used and by whom.

1. Open Event Viewer by pressing Windows + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 4674 in the Event IDs field and click OK
5. Double-click on recent Event ID 4674 entries to examine details
6. Focus on these key fields in the event details:
   • Subject: Account Name, Account Domain, Logon ID
   • Privilege: The specific privilege being used
   • Object: Object Server, Object Type, Object Name
   • Process Information: Process ID and Process Name
7. Look for patterns in privilege usage, unusual account activity, or unexpected processes exercising privileges

Use PowerShell to extract and analyze Event ID 4674 data programmatically for better pattern recognition.

1. Open PowerShell as Administrator
2. Query recent Event ID 4674 entries with detailed filtering:

# Get last 100 Event ID 4674 entries with key details
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4674} -MaxEvents 100 | 
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      TimeCreated = $_.TimeCreated
      SubjectUserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
      SubjectDomainName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectDomainName'} | Select-Object -ExpandProperty '#text'
      PrivilegeName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
      ObjectName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
      ProcessName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
    }
  } | Format-Table -AutoSize

3. Analyze privilege usage patterns by grouping common activities:

# Group events by privilege to identify most used privileges
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4674} -MaxEvents 1000 | 
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
  } | Group-Object | Sort-Object Count -Descending

4. Export results to CSV for further analysis in Excel or other tools:

# Export detailed privilege usage to CSV
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4674} -MaxEvents 500 | 
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      TimeCreated = $_.TimeCreated
      SubjectUserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
      PrivilegeName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
      ProcessName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
    }
  } | Export-Csv -Path "C:\Temp\Event4674_Analysis.csv" -NoTypeInformation

Properly configure audit policies to ensure Event ID 4674 captures the right level of detail for your security monitoring needs.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies
3. Expand Privilege Use and configure these settings:
   • Audit Sensitive Privilege Use: Set to Success to log successful privilege usage
   • Audit Non Sensitive Privilege Use: Set to Success and Failure for comprehensive monitoring
4. Use PowerShell to verify current audit settings:

# Check current privilege use audit settings
auditpol /get /subcategory:"Sensitive Privilege Use"
auditpol /get /subcategory:"Non Sensitive Privilege Use"

5. Configure specific privilege monitoring using the registry if needed:

# Enable audit for specific privileges (requires restart)
$regPath = "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit"
Set-ItemProperty -Path $regPath -Name "FullPrivilegeAuditing" -Value @("SeBackupPrivilege", "SeDebugPrivilege", "SeSystemtimePrivilege") -Type MultiString

6. Apply the policy and verify Event ID 4674 generation:

# Force group policy update
gpupdate /force

# Test privilege usage to generate Event ID 4674
# This command requires SeSystemtimePrivilege and will generate the event
w32tm /resync

Set up automated monitoring to detect suspicious privilege usage patterns and potential security incidents.

1. Create a PowerShell script for continuous monitoring of high-risk privilege usage:

# Create monitoring script: Monitor-PrivilegeUse.ps1
$HighRiskPrivileges = @(
    'SeDebugPrivilege',
    'SeBackupPrivilege', 
    'SeRestorePrivilege',
    'SeTakeOwnershipPrivilege',
    'SeLoadDriverPrivilege'
)

$LastCheck = (Get-Date).AddHours(-1)

Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4674
    StartTime=$LastCheck
} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $privilege = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
    $user = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
    $process = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
    
    if ($privilege -in $HighRiskPrivileges) {
        Write-Warning "High-risk privilege usage detected: $privilege by $user in process $process at $($_.TimeCreated)"
        # Add alerting logic here (email, SIEM integration, etc.)
    }
}

2. Set up a scheduled task to run the monitoring script:

# Create scheduled task for privilege monitoring
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-PrivilegeUse.ps1"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest

Register-ScheduledTask -TaskName "Monitor-PrivilegeUse" -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal

3. Configure Windows Event Forwarding for centralized collection:

# Configure event forwarding subscription (on collector server)
wecutil cs subscription.xml

# Example subscription.xml content for Event ID 4674:
# <?xml version="1.0" encoding="UTF-8"?>
# <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
#   <SubscriptionId>PrivilegeUseCollection</SubscriptionId>
#   <Query>
#     <![CDATA[
#       <QueryList>
#         <Query Id="0">
#           <Select Path="Security">*[System[EventID=4674]]</Select>
#         </Query>
#       </QueryList>
#     ]]>
#   </Query>
# </Subscription>

4. Create custom Event Viewer views for security analysis:

# Create custom view XML for Event Viewer
$CustomViewXML = @"
<ViewerConfig>
  <QueryConfig>
    <QueryParams>
      <Simple>
        <Channel>Security</Channel>
        <EventId>4674</EventId>
        <RelativeTimeInfo>604800000</RelativeTimeInfo>
      </Simple>
    </QueryParams>
  </QueryConfig>
</ViewerConfig>
"@

# Save to file for import into Event Viewer
$CustomViewXML | Out-File -FilePath "C:\Temp\PrivilegeUseView.xml" -Encoding UTF8

Perform deep forensic analysis of Event ID 4674 data to identify security incidents and attack patterns.

1. Create a comprehensive analysis script that correlates privilege usage with other security events:

# Advanced correlation analysis script
$StartTime = (Get-Date).AddDays(-7)
$EndTime = Get-Date

# Get all Event ID 4674 entries for analysis period
$PrivilegeEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4674
    StartTime=$StartTime
    EndTime=$EndTime
} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        SubjectUserSid = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserSid'} | Select-Object -ExpandProperty '#text'
        SubjectUserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
        SubjectLogonId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectLogonId'} | Select-Object -ExpandProperty '#text'
        PrivilegeName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
        ObjectName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectName'} | Select-Object -ExpandProperty '#text'
        ProcessId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
        ProcessName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text'
    }
}

# Analyze privilege usage patterns
$SuspiciousPatterns = $PrivilegeEvents | Group-Object SubjectUserName | Where-Object {
    $_.Count -gt 100 -or  # High volume of privilege usage
    ($_.Group.PrivilegeName | Sort-Object -Unique).Count -gt 5  # Using many different privileges
}

Write-Host "Potentially suspicious privilege usage patterns:"
$SuspiciousPatterns | ForEach-Object {
    Write-Host "User: $($_.Name), Event Count: $($_.Count), Unique Privileges: $(($_.Group.PrivilegeName | Sort-Object -Unique).Count)"
}

2. Correlate with logon events to identify privilege escalation attempts:

# Correlate privilege usage with logon events
$LogonEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=@(4624, 4625)  # Successful and failed logons
    StartTime=$StartTime
    EndTime=$EndTime
}

# Find users who had failed logons followed by privilege usage
$CorrelatedEvents = foreach ($privEvent in $PrivilegeEvents) {
    $relatedLogons = $LogonEvents | Where-Object {
        $xml = [xml]$_.ToXml()
        $logonUser = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
        $logonUser -eq $privEvent.SubjectUserName -and
        $_.TimeCreated -le $privEvent.TimeCreated -and
        $_.TimeCreated -ge $privEvent.TimeCreated.AddHours(-1)
    }
    
    if ($relatedLogons) {
        [PSCustomObject]@{
            User = $privEvent.SubjectUserName
            PrivilegeTime = $privEvent.TimeCreated
            Privilege = $privEvent.PrivilegeName
            RelatedLogons = $relatedLogons.Count
            Process = $privEvent.ProcessName
        }
    }
}

$CorrelatedEvents | Format-Table -AutoSize

3. Generate comprehensive security report:

# Generate detailed security analysis report
$ReportData = @{
    AnalysisPeriod = "$StartTime to $EndTime"
    TotalPrivilegeEvents = $PrivilegeEvents.Count
    UniqueUsers = ($PrivilegeEvents.SubjectUserName | Sort-Object -Unique).Count
    UniquePrivileges = ($PrivilegeEvents.PrivilegeName | Sort-Object -Unique).Count
    TopPrivileges = $PrivilegeEvents | Group-Object PrivilegeName | Sort-Object Count -Descending | Select-Object -First 10
    TopUsers = $PrivilegeEvents | Group-Object SubjectUserName | Sort-Object Count -Descending | Select-Object -First 10
    SuspiciousActivity = $SuspiciousPatterns
}

# Export comprehensive report
$ReportData | ConvertTo-Json -Depth 3 | Out-File -FilePath "C:\Temp\PrivilegeUseReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"

Write-Host "Security analysis complete. Report saved to C:\Temp\"