SOC Event Lookup
Event ID 4672LogonP1

Windows Event ID 4672: Special privileges assigned to new logon

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4672 records assignment of sensitive privileges to a newly created logon session.

Technical Metadata

Technical metadata for Event ID 4672
Event ID4672
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0004 Privilege Escalation / T1078 Valid Accounts
Key fields to watchSubject, Privilege List, Logon ID

Trigger Scenarios

The event is generated when a logon receives administrative privileges such as SeDebugPrivilege or SeTcbPrivilege.

Key Fields

Subject

The privileged identity and Logon ID. Use the Logon ID to join the event to its 4624 session.

Privilege List

The privileges assigned to the session. Their meaning depends on the account role and target system.

Logon ID

A session identifier used for correlation with logon, process, and object-access events.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4672
SecurityEvent
| where EventID == 4672
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4672
index=wineventlog source="WinEventLog:Security" EventCode=4672
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4672
dataset = microsoft_windows_raw
| filter edr_event_id = 4672
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4672
title: Windows Event ID 4672
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4672
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
PrivilegeListSeDebugPrivilegeThe new logon received the privilege to debug and adjust the memory of another process.Unexpected assignment supports investigation of process access and credential-dumping activity, but the assignment alone does not prove exploitation. Source
SubjectLogonId0x3e7This commonly identifies the LocalSystem logon session.Microsoft notes that 4672 is normally generated for SYSTEM logons; suppressing that baseline reduces noise without hiding unusual user sessions. Source

MITRE ATT&CK Mapping

  • T1078Valid Accounts

Detection Notes

Use 4672 as T1078 Valid Accounts privilege context rather than proof that privilege escalation occurred. SeDebugPrivilege on an unexpected user Logon ID is higher risk when related process and object-access telemetry shows access to lsass.exe; Logon ID 0x3e7 commonly represents LocalSystem and is a noisy baseline, while a Type 10 user session with the same privilege is a stronger deviation.

Common False Positives

  • Domain and local administrators create this event as part of normal operations.
  • Service accounts on servers may require privileged rights by design.

Related Events

Sample Log

Sanitized event sample
Subject: Account Name: CORP\admin.ops
Logon ID: 0x3e7
Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeDebugPrivilege

Frequently Asked Questions

What does Windows Event ID 4672 mean?

Event ID 4672 records that sensitive privileges were assigned to a new logon session, including privileges commonly held by administrators and service identities.

Is Event ID 4672 proof of privilege escalation?

No. It is normal for SYSTEM and administrator logons; the event becomes useful when the account, logon type, privilege list, or follow-on process behavior is unexpected.

Why is Logon ID important in Event ID 4672?

The Logon ID joins the privilege assignment to the corresponding 4624 logon and to subsequent activity attributed to that session.

Sources