detection.wiki

Windows Privileges

These sections describe Windows privileges and list detection rules that explicitly reference a privilege or detect a related operation. Only the relevant rule branch establishes that relationship. A matching request does not establish that the privilege was held or used, or that the operation succeeded.

SeAssignPrimaryTokenPrivilege

Allows a caller to replace the access token a child process runs under. CreateProcessAsUser may require it. Windows policy: “Replace a process-level token.” [1][2][3]

Selected conditions
  • CreateProcessAsUser ordinarily requires SeIncreaseQuotaPrivilege and a primary token with suitable access. SeAssignPrimaryTokenPrivilege is conditional because a restricted version of the caller's primary token is exempt. After ERROR_PRIVILEGE_NOT_HELD, the caller can explicitly invoke CreateProcessWithLogonW as an alternative. The API does not automatically fall back. [3]
  • A first-party capture on Windows 11 22H2 build 10.0.22621, with Token Right Adjusted and Sensitive Privilege Use both auditing success and failure, recorded no 4703 and no 4673 for a CreateProcessAsUser call that needed this privilege. The API enables SeAssignPrimaryTokenPrivilege and SeIncreaseQuotaPrivilege for the duration of the call, and neither privilege emits 4703 on its own, so the enablement leaves no trace. A call that failed with ERROR_PRIVILEGE_NOT_HELD produced no failure 4673 either. Use event 4688 for this operation and treat the shared privilege events as unreliable for it. [3]
  • HackTool - SharpImpersonation Execution Sigma
    Rule selection
    • CommandLine match " technique:CreateProcessAsUserW"

    Detects a related operation. Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

    Rule predicate match: Selects CreateProcessAsUser or CreateProcessAsUserW in executable rule predicates. Microsoft documents SeAssignPrimaryTokenPrivilege as conditional for this API. A function name can be one tool mode or script definition and does not prove invocation or success. [3]

  • PowerShell Script with Token Impersonation Capabilities Elastic
    Rule selection
    • powershell.file.script_block_text in "CreatePRocessAsUserW"

    Detects a related operation. Detects PowerShell scripts that references token manipulation and impersonation APIs such as CreateProcessWithTokenW, DuplicateToken/ImpersonateLoggedOnUser, or AdjustTokenPrivileges (SeDebugPrivilege). Attackers abuse token impersonation to elevate privileges and bypass access controls.

    Rule predicate match: Selects CreateProcessAsUser or CreateProcessAsUserW in executable rule predicates. Microsoft documents SeAssignPrimaryTokenPrivilege as conditional for this API. A function name can be one tool mode or script definition and does not prove invocation or success. [3]

SeBackupPrivilege

When enabled and used through the appropriate backup access path, permits file reads despite the DACL. Windows policy: “Back up files and directories.” [1][4]

Selected conditions
  • Review privilege-use events only with the audit configuration in view because Backup privilege use is emitted only when the additional Backup and Restore privilege audit setting is enabled. [5]
  • Suspicious Remote Registry Access via SeBackupPrivilege Elastic
    Security-Auditing Event ID 4672: Special privileges assigned to new logon
    • winlog.event_data.PrivilegeList matches "SeBackupPrivilege"

    References this privilege in assignment or logon evidence. Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.

  • Dumping of Sensitive Hives Via Reg.EXE Sigma
    Rule selection
    • Image ends_with "\reg.exe"
    • CommandLine match " save "
    • CommandLine match "\system"

    Detects a related operation. Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

    Rule predicate match: Detects reg.exe with a save verb and sensitive local-machine hive material. Only the matched save branch is associated with RegSaveKey. Other branches such as export do not inherit this relationship, and process telemetry does not prove success. This match retains positive conditions from one rule unit, but does not establish that they occur in the same Boolean branch. [6]

  • Sensitive File Dump Via Wbadmin.EXE Sigma
    Rule selection
    • Image ends_with "\wbadmin.exe"
    • CommandLine match "start"
    • CommandLine match "backup"
    • CommandLine match "\config\SAM"

    Detects a related operation. Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

    Rule predicate match: Detects wbadmin with a start backup verb and sensitive source material. Windows Server Backup reads locked system files through the documented backup access that SeBackupPrivilege grants. The process query identifies an attempted command. It does not prove that the backup ran, that it succeeded, or that SeBackupPrivilege rather than an ordinary permission supplied the read. Do not infer the privilege from Backup Operators membership alone. This match retains positive conditions from one rule unit, but does not establish that they occur in the same Boolean branch. [7][8][4]

SeDebugPrivilege

When enabled, can permit cross-account process access despite the process DACL. Protected-process restrictions still apply. Windows policy: “Debug programs.” [1][9]

  • SeDebugPrivilege Enabled by a Suspicious Process Elastic
    Security-Auditing Event ID 4703: A user right was adjusted
    • winlog.event_data.EnabledPrivilegeList matches "SeDebugPrivilege"

    References this privilege in token adjustment evidence. Identifies a process running with a non-SYSTEM account that enables the SeDebugPrivilege privilege. Adversaries may enable this privilege to debug and modify other processes, typically reserved for system-level tasks, to escalate privileges and bypass access controls.

SeEnableDelegationPrivilege

Allows an authorized caller to mark user and computer accounts as trusted for delegation. Windows policy: “Enable computer and user accounts to be trusted for delegation.” [1][10]

Selected conditions
  • The privilege alone is insufficient because the caller also needs write access to the account control flags on the user or computer object. [10]
  • This user right has no meaning on domain member servers and workstations. Microsoft documents it as relevant on domain controllers and stand-alone computers. [10]
  • Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal Elastic
    Security-Auditing Event ID 4704: A user right was assigned
    • winlog.event_data.PrivilegeList = "SeEnableDelegationPrivilege"

    References this privilege in assignment or logon evidence. Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user right" to a security principal. This right enables computer and user accounts to be trusted for delegation. Attackers can abuse it to compromise Active Directory accounts and elevate their privileges.

  • Enabled User Right in AD to Control User Objects Sigma
    Security-Auditing Event ID 4704: A user right was assigned
    • PrivilegeList contains "SeEnableDelegationPrivilege"

    References this privilege in assignment or logon evidence. Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

SeImpersonatePrivilege

Allows programs running for the holder to impersonate a client after authentication and act in the client's security context. Windows policy: “Impersonate a client after authentication.” [1][11]

Selected conditions
  • What an impersonating thread can do depends on the impersonation token's level. Lower levels do not grant the same local or remote authority as delegation. [12]
  • The shared privilege events do not by themselves identify the client token that was impersonated or prove the resulting access. [11]
  • WinAPI Function Calls Via PowerShell Scripts Sigma
    Rule selection
    • ScriptBlockText match "CreateProcessWithToken"
    • ScriptBlockText match "ImpersonateLoggedOnUser"

    Detects a related operation. Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.

    Rule predicate match: Selects a CreateProcessWithToken API reference in script or command content. Microsoft documents SeImpersonatePrivilege as a prerequisite for the calling process. Selects ImpersonateLoggedOnUser in executable command or script predicates. Text can be a definition or one alternative in a broader rule. It does not establish API invocation, privilege possession, or successful process creation. Microsoft documents cases where this API does not require SeImpersonatePrivilege. An API name can also be a definition or reference and does not prove invocation or success. [13][14]

  • HackTool - SharpImpersonation Execution Sigma
    Rule selection
    • CommandLine match " technique:ImpersonateLoggedOnuser"

    Detects a related operation. Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

    Rule predicate match: Selects ImpersonateLoggedOnUser in executable command or script predicates. Microsoft documents cases where this API does not require SeImpersonatePrivilege. An API name can also be a definition or reference and does not prove invocation or success. [14]

  • Potential WinAPI Calls Via CommandLine Sigma
    Rule selection
    • CommandLine match "CreateProcessWithToken"
    • CommandLine match "ImpersonateLoggedOnUser"

    Detects a related operation. Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

    Rule predicate match: Selects a CreateProcessWithToken API reference in script or command content. Microsoft documents SeImpersonatePrivilege as a prerequisite for the calling process. Selects ImpersonateLoggedOnUser in executable command or script predicates. Text can be a definition or one alternative in a broader rule. It does not establish API invocation, privilege possession, or successful process creation. Microsoft documents cases where this API does not require SeImpersonatePrivilege. An API name can also be a definition or reference and does not prove invocation or success. [13][14]

  • PowerShell Script with Token Impersonation Capabilities Elastic
    Rule selection
    • powershell.file.script_block_text in "CreateProcessWithTokenW"
    • powershell.file.script_block_text in "ImpersonateLoggedOnUser"
    • powershell.file.script_block_text eq "ImpersonateNamedPipeClient"

    Detects a related operation. Detects PowerShell scripts that references token manipulation and impersonation APIs such as CreateProcessWithTokenW, DuplicateToken/ImpersonateLoggedOnUser, or AdjustTokenPrivileges (SeDebugPrivilege). Attackers abuse token impersonation to elevate privileges and bypass access controls.

    Rule predicate match: Selects a CreateProcessWithToken API reference in script or command content. Microsoft documents SeImpersonatePrivilege as a prerequisite for the calling process. Selects ImpersonateLoggedOnUser in executable command or script predicates. Selects a named-pipe or thread impersonation API in executable PowerShell rule predicates. Text can be a definition or one alternative in a broader rule. It does not establish API invocation, privilege possession, or successful process creation. Microsoft documents cases where this API does not require SeImpersonatePrivilege. An API name can also be a definition or reference and does not prove invocation or success. Script text can be a definition, reference, or alternative branch. It does not prove API invocation, token capture, or successful impersonation. [13][14][15][16]

SeIncreaseBasePriorityPrivilege

Allows a caller with write access to another process to raise that process's base priority class. Windows policy: “Increase scheduling priority.” [1][17]

Selected conditions
  • Raising another process's base priority also requires Write Property access to that process. Raising relative priority within one priority class does not require this privilege. [17]

SeIncreaseQuotaPrivilege

Allows a caller to change the maximum memory quota assigned to a process. Windows policy: “Adjust memory quotas for a process.” [1][18]

Selected conditions
  • CreateProcessAsUser can enable SeIncreaseQuotaPrivilege for the duration of the call when the caller already holds it. A policy assignment becomes effective at the account's next logon. [3][18]
  • CreateProcessAsUser typically requires this privilege. A rule naming that API does not show whether Windows enabled it for the call or whether the call succeeded. [3]
  • HackTool - SharpImpersonation Execution Sigma
    Rule selection
    • CommandLine match " technique:CreateProcessAsUserW"

    Detects a related operation. Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

    Rule predicate match: Selects CreateProcessAsUser or CreateProcessAsUserW in executable rule predicates. Microsoft documents SeIncreaseQuotaPrivilege as ordinarily required. A function name can be one tool mode or script definition and does not prove invocation or success. [3]

  • PowerShell Script with Token Impersonation Capabilities Elastic
    Rule selection
    • powershell.file.script_block_text in "CreatePRocessAsUserW"

    Detects a related operation. Detects PowerShell scripts that references token manipulation and impersonation APIs such as CreateProcessWithTokenW, DuplicateToken/ImpersonateLoggedOnUser, or AdjustTokenPrivileges (SeDebugPrivilege). Attackers abuse token impersonation to elevate privileges and bypass access controls.

    Rule predicate match: Selects CreateProcessAsUser or CreateProcessAsUserW in executable rule predicates. Microsoft documents SeIncreaseQuotaPrivilege as ordinarily required. A function name can be one tool mode or script definition and does not prove invocation or success. [3]

SeLoadDriverPrivilege

Allows a caller to load or unload a device driver or other code into kernel mode. Windows policy: “Load and unload device drivers.” [1]

Selected conditions
  • The privilege authorizes dynamic driver load and unload operations. The documented user right does not apply to Plug and Play drivers. [19]
  • Holding the privilege does not disable Windows driver-signing and installation policy enforcement. [20]
  • Potential Privileged System Service Operation - SeLoadDriverPrivilege Sigma
    Security-Auditing Event ID 4673: A privileged service was called
    • PrivilegeList = "SeLoadDriverPrivilege"

    References this privilege in an operation request. Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

  • Filter Driver Unloaded Via Fltmc.EXE Sigma
    Rule selection
    • Image ends_with "\fltMC.exe"
    • CommandLine match "unload"

    Detects a related operation. Detect filter driver unloading activity via fltmc.exe

    Rule predicate match: Detects fltmc.exe with an unload verb. Microsoft documents the underlying FilterUnload privilege requirement. Process creation proves only that the command was attempted, not that the filter unload succeeded. This match retains positive conditions from one rule unit, but does not establish that they occur in the same Boolean branch. [21]

  • Sysmon Driver Unloaded Via Fltmc.EXE Sigma
    Rule selection
    • Image ends_with "\fltMC.exe"
    • CommandLine match "unload"

    Detects a related operation. Detects possible Sysmon filter driver unloaded via fltmc.exe

    Rule predicate match: Detects fltmc.exe with an unload verb. Microsoft documents the underlying FilterUnload privilege requirement. Process creation proves only that the command was attempted, not that the filter unload succeeded. This match retains positive conditions from one rule unit, but does not establish that they occur in the same Boolean branch. [21]

SeMachineAccountPrivilege

Allows an assigned user to add devices and their machine accounts to a domain through a domain controller. Windows policy: “Add workstations to domain.” [1][22]

Selected conditions
  • A holder can add workstations to the domain through this user right. The default machine-account quota permits up to ten additions and can be configured by the domain administrator. [22][23]
  • Create Computer Objects permission on the target organizational unit or Computers container is a separate path that can allow unlimited device additions without this user right. [22]
  • Privilege SeMachineAccountPrivilege abuse Sigma
    Security-Auditing Event ID 4673: A privileged service was called
    • PrivilegeList = "SeMachineAccountPrivilege"

    References this privilege in an operation request. Detects scenarios where an attacker abuse the SeMachineAccountPrivilege which allows per default any authenticated user to join a computer to the domain. Later on, this computer account can be manipulated in order to elevate privileges.

SeRestorePrivilege

When enabled and used through the appropriate restore access path, permits file writes despite the DACL. Windows policy: “Restore files and directories.” [1][4]

Selected conditions
  • Restore semantics can also change an object's owner and protection, including assigning a valid SID as owner. [1][4]
  • Interpret privilege-use evidence with the audit configuration because Restore privilege use is emitted only when the additional Backup and Restore privilege audit setting is enabled. [5]
  • File Recovery From Backup Via Wbadmin.EXE Sigma
    Rule selection
    • Image ends_with "\wbadmin.exe"
    • CommandLine match " recovery"

    Detects a related operation. Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

    Rule predicate match: Detects wbadmin with a recovery verb. Restoring content from backup media writes through the documented restore access that SeRestorePrivilege grants. The process query identifies an attempted command. It does not prove that the recovery ran, that it succeeded, or that SeRestorePrivilege rather than an ordinary permission supplied the write. The pattern selects the recovery verb shared by the matched rules and does not require the sensitive target material that some of them add. Matching is per rule unit, so for a rule that alternates over many utilities the wbadmin identity and the recovery verb were confirmed on review to sit in the same branch. Do not infer the privilege from Backup Operators membership alone. This match retains positive conditions from one rule unit, but does not establish that they occur in the same Boolean branch. [7][24][4]

  • Sensitive File Recovery From Backup Via Wbadmin.EXE Sigma
    Rule selection
    • Image ends_with "\wbadmin.exe"
    • CommandLine match " recovery"

    Detects a related operation. Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

    Rule predicate match: Detects wbadmin with a recovery verb. Restoring content from backup media writes through the documented restore access that SeRestorePrivilege grants. The process query identifies an attempted command. It does not prove that the recovery ran, that it succeeded, or that SeRestorePrivilege rather than an ordinary permission supplied the write. The pattern selects the recovery verb shared by the matched rules and does not require the sensitive target material that some of them add. Matching is per rule unit, so for a rule that alternates over many utilities the wbadmin identity and the recovery verb were confirmed on review to sit in the same branch. Do not infer the privilege from Backup Operators membership alone. This match retains positive conditions from one rule unit, but does not establish that they occur in the same Boolean branch. [7][24][4]

  • Windows WBAdmin File Recovery From Backup Splunk
    Rule selection
    • Processes.original_file_name eq "WBADMIN.EXE"
    • Processes.process eq "*recovery*"

    Detects a related operation. The following analytic identifies the execution of wbadmin.exe with arguments indicative of restoring files from an existing backup. WBAdmin is a legitimate Windows Backup utility used for creating, managing, and restoring backups. However, adversaries may abuse it to restore specific files (e.g., sensitive credentials, configuration files, or malware stagers) from prior backups to regain access or re-establish persistence after cleanup or encryption events. Monitoring this behavior is important because restoring individual files from a system backup outside of approved recovery workflows may indicate an attacker attempting to retrieve deleted or encrypted data, recover previously dropped payloads, or access prior system states as part of post-compromise activity. If confirmed malicious, this action could enable attackers to regain operational footholds, extract sensitive data, or restore tampered components, undermining remediation and containment efforts.

    Rule predicate match: Detects wbadmin with a recovery verb. Restoring content from backup media writes through the documented restore access that SeRestorePrivilege grants. The process query identifies an attempted command. It does not prove that the recovery ran, that it succeeded, or that SeRestorePrivilege rather than an ordinary permission supplied the write. The pattern selects the recovery verb shared by the matched rules and does not require the sensitive target material that some of them add. Matching is per rule unit, so for a rule that alternates over many utilities the wbadmin identity and the recovery verb were confirmed on review to sit in the same branch. Do not infer the privilege from Backup Operators membership alone. This match retains positive conditions from one rule unit, but does not establish that they occur in the same Boolean branch. [7][24][4]

SeTakeOwnershipPrivilege

Allows a caller to take ownership of a securable object without being granted WRITE_OWNER by the object's DACL. Windows policy: “Take ownership of files or other objects.” [1][25]

Selected conditions
  • The privilege supplies ownership-related access. It does not grant unrestricted read or write access to every object. [1][25]
  • SCM Database Privileged Operation Sigma
    Security-Auditing Event ID 4674: An operation was attempted on a privileged object
    • PrivilegeList = "SeTakeOwnershipPrivilege"

    References this privilege in an operation request. Detects non-system users performing privileged operation os the SCM database

  • Suspicious Recursive Takeown Sigma
    Rule selection
    • Image ends_with "\takeown.exe"
    • CommandLine match "/f "

    Detects a related operation. Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

    Rule predicate match: Detects takeown.exe with a target selected through the /f argument. The command attempts an ownership change. It does not prove success or that SeTakeOwnershipPrivilege supplied access because WRITE_OWNER may come from the object DACL. [26][25]

SeCreateTokenPrivilege

Allows a caller to create a token through a native token creation API, distinct from duplicating an existing token. Windows policy: “Create a token object.” [1][27]

No rules currently associated with this section.

SeSecurityPrivilege

When enabled, permits security audit administration and access to an object's SACL through ACCESS_SYSTEM_SECURITY. Windows policy: “Manage auditing and security log.” [1][28][29]

Selected conditions
  • Auditpol operations can be authorized through descriptor permissions. SeBackupPrivilege or SeRestorePrivilege can also grant ACCESS_SYSTEM_SECURITY for documented file backup or restore paths. An access mask alone does not identify which privilege supplied access. [30][31][1]

No rules currently associated with this section.

SeTcbPrivilege

Identifies a process as part of the trusted computing base and permits it to assume another user's identity without authentication. Windows policy: “Act as part of the operating system.” [1][32]

Selected conditions
  • Microsoft documents that a holder can build a token without a primary identity for auditing, so event identity may not fully explain resulting activity. [32]

No rules currently associated with this section.

References #