Windows Privileges

This page covers a selected set of Windows privileges.

Security-Auditing Event ID 4672: Special privileges assigned to new logon
Security-Auditing Event ID 4673: A privileged service was called
Security-Auditing Event ID 4674: An operation was attempted on a privileged object
Security-Auditing Event ID 4703: A user right was adjusted
Security-Auditing Event ID 4704: A user right was assigned
Security-Auditing Event ID 4705: A user right was removed

SeBackupPrivilege

When enabled and used through the appropriate backup access path, permits file reads despite the DACL. [1][2]

Suspicious Remote Registry Access via SeBackupPrivilege Elastic
Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.

When enabled, can permit cross-account process access despite the process DACL. Protected-process restrictions still apply. [1][3]

SeDebugPrivilege Enabled by a Suspicious Process Elastic
Identifies a process running with a non-SYSTEM account that enables the SeDebugPrivilege privilege. Adversaries may enable this privilege to debug and modify other processes, typically reserved for system-level tasks, to escalate privileges and bypass access controls.

Allows an authorized caller to mark user and computer accounts as trusted for delegation. [1][4]

Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal Elastic
Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user right" to a security principal. This right enables computer and user accounts to be trusted for delegation. Attackers can abuse it to compromise Active Directory accounts and elevate their privileges.
Enabled User Right in AD to Control User Objects Sigma
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Allows a caller with write access to another process to raise that process's base priority class. [1][5]

Suspicious SeIncreaseBasePriorityPrivilege Use Elastic
Identifies attempts to use the SeIncreaseBasePriorityPrivilege privilege by an unusual process. This could be related to hijack execution flow of a process via threats priority manipulation.

Allows a caller to load or unload a device driver or other code into kernel mode. [1][6]

Potential Privileged System Service Operation - SeLoadDriverPrivilege Sigma
Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

Allows an assigned user to add devices and their machine accounts to a domain through a domain controller. [1][7]

Privilege SeMachineAccountPrivilege abuse Sigma
Detects scenarios where an attacker abuse the SeMachineAccountPrivilege which allows per default any authenticated user to join a computer to the domain. Later on, this computer account can be manipulated in order to elevate privileges.

Allows a caller to take ownership of a securable object without being granted WRITE_OWNER by the object's DACL. [1][8]

SCM Database Privileged Operation Sigma
Detects non-system users performing privileged operation os the SCM database

Allows a caller to replace the access token a child process runs under. CreateProcessAsUser may require it. [1][9][10]