Windows Event ID 4696 – Microsoft-Windows-Security-Auditing: Primary Token Assigned to Process

Start by examining the specific Event ID 4696 entries to understand the process creation context and security token details.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 4696 in the Event IDs field and click OK
5. Double-click on recent Event ID 4696 entries to examine details
6. Review key fields including:
   • Subject: User account that created the process
   • New Process Information: Target executable and process ID
   • Token Information: Security context and privileges
   • Process Information: Parent process details

Pay special attention to processes created with elevated privileges or unusual parent-child relationships that might indicate suspicious activity.

Use PowerShell to efficiently query and analyze Event ID 4696 entries with specific filtering criteria.

1. Open PowerShell as Administrator
2. Query recent Event ID 4696 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddHours(-24)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed process information:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696} -MaxEvents 20 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ProcessName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'} | Select-Object -ExpandProperty '#text'
           ProcessId = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessId'} | Select-Object -ExpandProperty '#text'
           SubjectUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       }
   }

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696} -MaxEvents 100 | Export-Csv -Path "C:\Temp\Event4696_Analysis.csv" -NoTypeInformation

Ensure proper audit policy configuration to capture Event ID 4696 entries with appropriate detail levels.

1. Open Local Security Policy by running secpol.msc as Administrator
2. Navigate to Security Settings → Advanced Audit Policy Configuration → Audit Policies → Detailed Tracking
3. Double-click Audit Process Creation
4. Check both Success and Failure options
5. Click OK to apply changes
6. For Group Policy environments, configure via:
   • Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
7. Verify current audit settings with PowerShell:

   auditpol /get /category:"Detailed Tracking"

8. Enable command line auditing for enhanced process tracking:

   reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

9. Restart the system or run gpupdate /force to apply policy changes

Perform detailed analysis of security token information within Event ID 4696 to identify privilege escalation or suspicious token assignments.

1. Extract token information from events using PowerShell:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       $TokenType = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TokenType'} | Select-Object -ExpandProperty '#text'
       $ImpersonationLevel = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'ImpersonationLevel'} | Select-Object -ExpandProperty '#text'
       $NewProcessName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'} | Select-Object -ExpandProperty '#text'
       
       Write-Output "Process: $NewProcessName | Token Type: $TokenType | Impersonation: $ImpersonationLevel"
   }

2. Check for processes with elevated privileges:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696} | Where-Object {
       $_.Message -match "TokenType.*Primary" -and $_.Message -match "ImpersonationLevel.*%%1833"
   } | Select-Object TimeCreated, Message

3. Identify unusual parent-child process relationships:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696} -MaxEvents 50 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       $ParentProcessName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'ParentProcessName'} | Select-Object -ExpandProperty '#text'
       $NewProcessName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'} | Select-Object -ExpandProperty '#text'
       
       if ($ParentProcessName -and $NewProcessName) {
           "$ParentProcessName -> $NewProcessName"
       }
   } | Group-Object | Sort-Object Count -Descending

4. Monitor for service account token assignments:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696} | Where-Object {
       $_.Message -match "SYSTEM|SERVICE|NETWORK SERVICE"
   } | Select-Object TimeCreated, @{Name='ProcessInfo';Expression={($_.Message -split '\n' | Select-String 'New Process Name').ToString()}}

Set up automated monitoring for Event ID 4696 to detect suspicious process creation patterns and security anomalies.

1. Create a PowerShell monitoring script:

   # Save as Monitor-Event4696.ps1
   param(
       [int]$CheckIntervalMinutes = 5,
       [string]$AlertLogPath = "C:\Logs\Event4696_Alerts.log"
   )
   
   $SuspiciousProcesses = @('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe')
   $LastCheck = (Get-Date).AddMinutes(-$CheckIntervalMinutes)
   
   while ($true) {
       $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4696; StartTime=$LastCheck} -ErrorAction SilentlyContinue
       
       foreach ($Event in $Events) {
           $EventXml = [xml]$Event.ToXml()
           $ProcessName = $EventXml.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'} | Select-Object -ExpandProperty '#text'
           $SubjectUser = $EventXml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           
           if ($SuspiciousProcesses -contains (Split-Path $ProcessName -Leaf)) {
               $AlertMessage = "ALERT: Suspicious process creation - $ProcessName by $SubjectUser at $($Event.TimeCreated)"
               Add-Content -Path $AlertLogPath -Value $AlertMessage
               Write-Warning $AlertMessage
           }
       }
       
       $LastCheck = Get-Date
       Start-Sleep -Seconds ($CheckIntervalMinutes * 60)
   }

2. Create a scheduled task to run the monitoring script:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-Event4696.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserID "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   
   Register-ScheduledTask -TaskName "Monitor-Event4696" -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings

3. Set up Windows Event Forwarding for centralized monitoring:

   # On collector server
   wecutil qc /q
   
   # Create subscription configuration
   $SubscriptionXml = @"
   
       Event4696-Collection
       SourceInitiated
       Collect Event ID 4696 from domain computers
       true
       http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog
       Normal
       
               
                   *[System[EventID=4696]]
               
           
       ]]>
   
   "@
   
   $SubscriptionXml | Out-File -FilePath "C:\Temp\Event4696-Subscription.xml"
   wecutil cs "C:\Temp\Event4696-Subscription.xml"