Event ID 4672: special privileges assigned to new logon
What Event ID 4672 (special privileges assigned to new logon) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4672 records that a new logon received sensitive privileges, which in practice means an administrator or a system account logged on. It is noisy, but it is also the quickest way to see where admin accounts are being used, and that is where attackers want to be.
The fields that matter
| Field | What it tells you |
|---|---|
| Account Name / Domain | Who received the privileges. |
| Logon ID | Matches the 4624 for the same session, which has the source address. |
| Privileges | The list granted, such as SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege and SeImpersonatePrivilege. |
What is normal
SYSTEM, LOCAL SERVICE, NETWORK SERVICE, machine accounts and admins logging on to the servers they manage.
When Event ID 4672 is suspicious
- An account that has never had admin rights suddenly appearing in 4672.
- Domain admin accounts logging on to ordinary workstations, where their credentials can be stolen.
- Admin logons at unusual hours or from unusual hosts (join with 4624 on Logon ID to get the source).
Common false positive: Filter out SYSTEM, the service accounts and names ending in $ first; most of the volume disappears.
Find Event ID 4672 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4672
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4624: Successful logon
- Event ID 4648: Logon with explicit credentials
- Event ID 4732: Member added to local security group
- Event ID 4728: Member added to global security group
FAQ
Is 4672 a sign of an attack by itself?
No. It is a marker of an admin session. It becomes interesting when the account or the host doesn't fit.
Why does 4672 have no source IP?
It only lists the privileges. Join it to the 4624 with the same Logon ID to see where the logon came from.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.