Windows Event ID 4675 – Microsoft-Windows-Security-Auditing: User Account Logon Rights Assignment

Start by examining the specific details of Event ID 4675 to understand what rights were modified and for which account.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4675 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4675 in the Event IDs field and click OK
5. Double-click on recent Event ID 4675 entries to examine the details
6. Review the General tab for the account name, privilege name, and process information
7. Check the Details tab for additional XML data including Security ID and process details

Key fields to examine include the Subject Security ID (who initiated the change), Target Account (which account was modified), and Privileges (which specific rights were assigned or removed).

Use PowerShell to efficiently query and analyze Event ID 4675 occurrences across specific time periods.

1. Open PowerShell as Administrator
2. Query recent Event ID 4675 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events for a specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed information from event properties:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           TargetUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           PrivilegeName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'} | Select-Object -ExpandProperty '#text'
       }
   }

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675} -MaxEvents 100 | Export-Csv -Path "C:\Temp\Event4675_Analysis.csv" -NoTypeInformation

Investigate whether Event ID 4675 occurrences correlate with Group Policy processing cycles, which is the most common legitimate cause.

1. Check Group Policy processing events in the System log:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} -MaxEvents 20

2. Review Group Policy operational logs:

   Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-2)}

3. Open Group Policy Management Console (gpmc.msc) to review applied policies
4. Navigate to the target computer or user object and check Group Policy Results
5. Run Group Policy refresh to test if Event ID 4675 appears:

   gpupdate /force

6. Monitor the Security log during Group Policy processing:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675; StartTime=(Get-Date).AddMinutes(-5)} | Format-Table TimeCreated, Message -Wrap

7. Verify current user rights assignments:

   secedit /export /cfg C:\Temp\current_security_policy.inf
   notepad C:\Temp\current_security_policy.inf

Examine whether Event ID 4675 relates to service account privilege modifications, which often occur during software installation or service configuration.

1. Check recent service installations and modifications:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034,7035,7036,7040} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

2. Review services that run under specific accounts:

   Get-WmiObject Win32_Service | Where-Object {$_.StartName -ne 'LocalSystem' -and $_.StartName -ne 'NT AUTHORITY\LocalService' -and $_.StartName -ne 'NT AUTHORITY\NetworkService'} | Select-Object Name, StartName, State

3. Examine Windows Installer logs for service-related installations:

   Get-WinEvent -LogName 'Application' | Where-Object {$_.ProviderName -eq 'MsiInstaller' -and $_.TimeCreated -gt (Get-Date).AddDays(-1)} | Format-Table TimeCreated, Message -Wrap

4. Check for recent software installations in Programs and Features:

   Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Application'} | Where-Object {$_.Message -like '*install*' -and $_.TimeCreated -gt (Get-Date).AddDays(-1)}

5. Review the Local Security Policy for service logon rights:
   Open Local Security Policy (secpol.msc) → Local Policies → User Rights Assignment → Log on as a service
6. Correlate service changes with Event ID 4675 timing:

   $ServiceEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034,7035,7036} -MaxEvents 20
   $SecurityEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675} -MaxEvents 20
   Compare-Object $ServiceEvents.TimeCreated $SecurityEvents.TimeCreated -IncludeEqual

Implement comprehensive monitoring and forensic analysis to detect unauthorized privilege modifications and establish baseline behavior patterns.

1. Create a PowerShell monitoring script for continuous Event ID 4675 tracking:

   # Save as Monitor-Event4675.ps1
   $LastCheck = (Get-Date).AddMinutes(-5)
   while ($true) {
       $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675; StartTime=$LastCheck}
       foreach ($Event in $Events) {
           $EventXML = [xml]$Event.ToXml()
           $SubjectUser = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           $TargetUser = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
           $Privilege = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeName'}).'#text'
           
           Write-Host "[$(Get-Date)] Event ID 4675 - Subject: $SubjectUser, Target: $TargetUser, Privilege: $Privilege" -ForegroundColor Yellow
       }
       $LastCheck = Get-Date
       Start-Sleep -Seconds 300
   }

2. Set up Windows Event Forwarding for centralized monitoring:
   Configure Event Collector service: wecutil qc
   Create custom subscription for Event ID 4675
3. Implement registry monitoring for security policy changes:

   $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
   Get-ItemProperty -Path $RegPath | Format-List

4. Create baseline documentation of normal Event ID 4675 patterns:

   # Generate baseline report
   $BaselineEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675} -MaxEvents 200
   $BaselineEvents | Group-Object {($_.Message -split '\n')[0]} | Sort-Object Count -Descending | Format-Table Name, Count -Wrap

5. Configure Windows Event Log size and retention for adequate forensic coverage:

   wevtutil sl Security /ms:1073741824  # Set Security log to 1GB
   wevtutil sl Security /rt:false       # Disable log overwrite

6. Integrate with SIEM or log analysis tools using WinLogBeat or similar agents
7. Set up automated alerting for suspicious patterns:

   # Alert on Event ID 4675 outside business hours
   $CurrentHour = (Get-Date).Hour
   if ($CurrentHour -lt 8 -or $CurrentHour -gt 18) {
       $RecentEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4675; StartTime=(Get-Date).AddMinutes(-10)}
       if ($RecentEvents.Count -gt 0) {
           # Send alert - implement your notification method
           Write-Warning "Suspicious Event ID 4675 activity detected outside business hours"
       }
   }