User Right Assigned
Query
// Use Case: Identifying and analyzing security-related events, specifically the enabling of a user's right to perform privileged tasks, within the last 7 days in a Windows environment.
WindowsEvent('Security', 7d)
| where tostring(EventId) == '4704'Explanation
This query is designed to help identify and analyze security-related events in a Windows environment. Specifically, it focuses on detecting instances where a user's rights to perform privileged tasks have been enabled within the last 7 days. Here's a breakdown of the query:
-
WindowsEvent('Security', 7d): This part of the query retrieves security events from the Windows event logs that have occurred in the past 7 days. -
| where tostring(EventId) == '4704': This filters the events to only include those with an Event ID of '4704'. In Windows security logs, Event ID 4704 indicates that a user right has been assigned, which often relates to enabling a user to perform privileged tasks.
In simple terms, this query looks at the security logs from the past week to find events where a user has been granted the ability to perform tasks that require higher privileges.
Details
Ugur Koc
Released: December 13, 2024
Tables
Keywords
Operators