Windows Event ID 4876 – Security: Special Privileges Assigned to New Logon

Start by examining the specific details of Event ID 4876 to understand which privileges were assigned and to which account.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4876 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4876 in the Event IDs field and click OK
5. Double-click on a 4876 event to view details
6. Review the General tab for account information and assigned privileges
7. Check the Details tab for XML data containing privilege names

Use PowerShell to efficiently query and analyze Event ID 4876 occurrences across your system.

1. Open PowerShell as Administrator
2. Run the following command to retrieve recent 4876 events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4876} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. For more detailed analysis, extract specific event properties:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4876} -MaxEvents 20 | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        SubjectUserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
        TargetUserName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
        PrivilegeList = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeList'} | Select-Object -ExpandProperty '#text'
    }
}

4. To search for specific privilege assignments, filter by privilege name:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4876} | Where-Object {$_.Message -like '*SeDebugPrivilege*'}

Investigate patterns in privilege assignments to identify normal behavior versus potential security concerns.

1. Create a PowerShell script to analyze privilege assignment frequency:

$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4876; StartTime=(Get-Date).AddDays(-7)}
$privilegeStats = @{}

foreach ($event in $events) {
    $xml = [xml]$event.ToXml()
    $privileges = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeList'} | Select-Object -ExpandProperty '#text'
    $user = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
    
    if ($privileges) {
        $key = "$user - $privileges"
        if ($privilegeStats.ContainsKey($key)) {
            $privilegeStats[$key]++
        } else {
            $privilegeStats[$key] = 1
        }
    }
}

$privilegeStats.GetEnumerator() | Sort-Object Value -Descending | Format-Table Name, Value

2. Check for unusual privilege assignments by comparing against baseline behavior
3. Review the User Rights Assignment policy in Group Policy Management Console
4. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment
5. Verify that privilege assignments align with organizational security policies

Enhance privilege monitoring by configuring advanced audit policies for better visibility into privilege assignments.

1. Open Local Group Policy Editor by running gpedit.msc
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Privilege Use
3. Enable Audit Sensitive Privilege Use for both Success and Failure
4. Apply the policy by running:

gpupdate /force

5. For domain environments, configure the audit policy through Group Policy Management:

auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable

6. Verify the audit configuration:

auditpol /get /subcategory:"Sensitive Privilege Use"

Set up automated monitoring to detect suspicious privilege assignment activities in real-time.

1. Create a scheduled task to monitor for unusual privilege assignments:

$action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\Monitor-PrivilegeAssignments.ps1'
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365)
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
Register-ScheduledTask -TaskName "Monitor-Event4876" -Action $action -Trigger $trigger -Principal $principal

2. Create the monitoring script at C:\Scripts\Monitor-PrivilegeAssignments.ps1:

# Monitor-PrivilegeAssignments.ps1
$lastCheck = (Get-Date).AddMinutes(-15)
$suspiciousPrivileges = @('SeDebugPrivilege', 'SeTakeOwnershipPrivilege', 'SeLoadDriverPrivilege')

$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4876; StartTime=$lastCheck} -ErrorAction SilentlyContinue

foreach ($event in $events) {
    $xml = [xml]$event.ToXml()
    $privileges = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PrivilegeList'} | Select-Object -ExpandProperty '#text'
    $user = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
    
    foreach ($suspiciousPriv in $suspiciousPrivileges) {
        if ($privileges -like "*$suspiciousPriv*") {
            Write-EventLog -LogName Application -Source "PrivilegeMonitor" -EventId 1001 -EntryType Warning -Message "Suspicious privilege assignment: $suspiciousPriv to user $user at $($event.TimeCreated)"
        }
    }
}

3. Register the custom event source:

New-EventLog -LogName Application -Source "PrivilegeMonitor"

4. Configure Windows Event Forwarding (WEF) to centralize privilege monitoring across multiple systems