Event ID 4672 indicates that a new Windows session has received sensitive privileges. It often appears just after a 4624 and must be correlated with the same Logon ID to distinguish an expected elevation from a use of privileges to be investigated.
Source of event
Microsoft-Windows-Security-Auditing — Security category.
Possible causes
The presence of a 4672 does not prove a compromise. SYSTEM, administrators, certain services and planned tasks can generate this event normally. The signal becomes more interesting when the account, the schedule, type of connection or source machine do not match the intended usage. Avoid, therefore, alerting on the number alone: correlation 4624/4672 and account context are indispensable.
Verifications to be carried out
Start by picking up Subject ‘User’, the field and especially the Logon ID. Then look for the Event ID 4624 with the same session ID to obtain the type of connection, the source machine and, as the case may be, the network address. Finally, check whether the account should actually have administrative privileges or system privileges at that time.
- Identify the account and Logon ID.
- Correlate with 4624.
- Compare with planned administrative actions.
- Extending the timeline to process creation events if the activity remains unexplained.
Useful orders….
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} -MaxEvents 30Correlate 4672 with Windows Timeline
For an investigation, build a small timeline around the time stamp: 4624 for the opening of the session, 4672 for privileges, then relevant process or service events. A Power Shell filter with Get-WinEvent allows you to reduce the time and keep useful fields. Document the account, source and action observed before any conclusion or blocking.
To be retained….
An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.
FAQ — Event ID 4672
4672 does it mean that, a director, has logged in?
It indicates that a session has received sensitive privileges. You need to identify the account and correlate the Logon ID with 4624 to know the exact context.
Why do we often see 4624 and then 4672?
Event ID 4624 records the successful logon; 4672 can then indicate the special privileges assigned to this session.
Should we keep all 4672 alert?.
No. The legitimate system, services and administrators accounts also produce them. alert must take account of the account, source, schedule and associated activity.