Windows Event ID 6274 – Microsoft-Windows-Security-Auditing: Special Privileges Assigned to New Logon

Start by examining the specific details of Event ID 6274 to understand which privileges were assigned and to which user account.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 6274 by right-clicking the Security log and selecting Filter Current Log
4. Enter 6274 in the Event IDs field and click OK
5. Double-click on a 6274 event to view detailed information including:
   • Subject: User account that received privileges
   • Logon ID: Session identifier for correlation
   • Privileges: List of special privileges assigned
6. Note the timestamp and correlate with other security events using the Logon ID

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6274} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='LogonId';Expression={$_.Properties[2].Value}}

Examine patterns in privilege assignments to identify normal versus suspicious activity and ensure proper access control.

1. Query events for specific users to establish baseline privilege patterns:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6274} -MaxEvents 1000
$Events | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        User = $xml.Event.EventData.Data[1].'#text'
        LogonId = $xml.Event.EventData.Data[2].'#text'
        Privileges = $xml.Event.EventData.Data[4].'#text'
    }
} | Group-Object User | Sort-Object Count -Descending

2. Review the Local Security Policy to verify user rights assignments:
   • Run secpol.msc as administrator
   • Navigate to Local Policies → User Rights Assignment
   • Check assignments for privileges like "Debug programs", "Load and unload device drivers", "Act as part of the operating system"
3. Compare assigned privileges against job requirements and principle of least privilege
4. Document any unexpected privilege assignments for further investigation

Link Event ID 6274 with related logon events to build a complete picture of user session establishment and privilege usage.

1. Identify the Logon ID from Event 6274 and search for corresponding logon events:

$LogonId = "0x3e7"  # Replace with actual Logon ID from Event 6274
$RelatedEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4634,4647,6274} | Where-Object {
    $_.Message -match $LogonId
} | Sort-Object TimeCreated

2. Analyze the sequence of events to understand the complete logon session:
   • Event 4624: Successful logon
   • Event 6274: Special privileges assigned
   • Event 4634/4647: Logoff events
3. Check for privilege usage events that follow privilege assignment:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672,4673,4674} | Where-Object {
    $_.TimeCreated -gt (Get-Date).AddHours(-24) -and $_.Message -match $LogonId
}

4. Review Process and Thread audit events (4688, 4689) to see if elevated privileges were actually used
5. Generate a timeline report combining all related events for comprehensive analysis

Set up proactive monitoring to detect unusual privilege assignments and potential security threats in real-time.

1. Create a custom Windows Event Forwarding (WEF) subscription to centralize Event 6274 collection:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>PrivilegeAssignment</SubscriptionId>
    <Query>
        <Select Path="Security">*[System[(EventID=6274)]]</Select>
    </Query>
</Subscription>

2. Configure Group Policy to enable advanced audit policy for privilege use:
   • Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Enable Audit Sensitive Privilege Use and Audit Non Sensitive Privilege Use
3. Create PowerShell monitoring script for real-time alerting:

Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=6274" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    $Message = $Event.Message
    if ($Message -match "SeDebugPrivilege|SeTcbPrivilege|SeLoadDriverPrivilege") {
        Send-MailMessage -To "security@company.com" -Subject "High-Risk Privilege Assignment" -Body $Message -SmtpServer "mail.company.com"
    }
}

4. Integrate with SIEM solutions using Windows Event Collector or third-party agents
5. Set up automated response procedures for critical privilege assignments

Perform detailed forensic analysis of privilege assignments for security investigations and compliance requirements.

1. Export Event 6274 data for long-term analysis and compliance reporting:

$StartDate = (Get-Date).AddDays(-30)
$EndDate = Get-Date
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6274; StartTime=$StartDate; EndTime=$EndDate}

$Report = $Events | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        Computer = $_.MachineName
        User = $xml.Event.EventData.Data[1].'#text'
        LogonId = $xml.Event.EventData.Data[2].'#text'
        LogonType = $xml.Event.EventData.Data[3].'#text'
        Privileges = $xml.Event.EventData.Data[4].'#text'
    }
}

$Report | Export-Csv -Path "C:\Reports\PrivilegeAssignments_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

2. Analyze privilege assignment frequency and patterns for anomaly detection:

$Report | Group-Object User | Sort-Object Count -Descending | Select-Object Name, Count, @{Name='LastAssignment';Expression={($_.Group | Sort-Object TimeCreated -Descending)[0].TimeCreated}}

3. Cross-reference with Active Directory to validate user permissions:

Import-Module ActiveDirectory
$UniqueUsers = $Report | Select-Object -ExpandProperty User -Unique
foreach ($User in $UniqueUsers) {
    try {
        $ADUser = Get-ADUser -Identity $User -Properties MemberOf
        Write-Output "$User groups: $($ADUser.MemberOf -join '; ')"
    } catch {
        Write-Warning "Could not find AD user: $User"
    }
}

4. Generate compliance reports showing privilege assignment trends and policy adherence
5. Archive forensic data according to organizational retention policies