Event ID 4672: Special privileges assigned to new logon
Written right after a 4624 when the account that logged on has administrator-level privileges, such as SeDebugPrivilege or SeTakeOwnershipPrivilege.
- Log
- Security
- Category
- Logon
Why it matters
- A quick way to find administrator logons: an unexpected account here deserves attention.
- SeDebugPrivilege lets a process read other processes' memory, which credential dumping tools need.
What to check
Match the Logon ID to the 4624 before it and check the account is expected to have admin rights on this host.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Special Logon (Success).
MITRE ATT&CK
- T1078 Valid Accounts