author: Zach Mathis
date: 2020/11/08
modified: 2021/11/26

title: Unknown process used a high privilege
title_jp: 不明なプロセスが高い権限を使った
output: 'Process: %ProcessName%  :  User: %SubjectUserName%  :  LogonID: %SubjectLogonId%'
output_jp: 'プロセス名: %ProcessName%  :  ユーザ名: %SubjectUserName%  :  ログオンID: %SubjectLogonId%'
description: |
    Malware may generate a 4673 event (A privileged service was called) when dumping hashes or wiping disk. 
    For example, mimikatz will generate 4 logs using SeTcbPrivilege (Act as part of the OS.) 
    Disk wipers like bcwipe will also generate this.
    More legitimate filepaths may have to be added to the filter.
    This is marked as a medium alert as there is a high possibility for false positives.
description_jp: 

id: 5b6e58ee-c231-4a54-9eee-af2577802e08
level: medium
status: stable
detection:
    selection:
        Channel: Security
        EventID: 4673
    filter: 
        - ProcessName: C:\Windows\System32\net.exe
        - ProcessName: C:\Windows\System32\lsass.exe
        - ProcessName: C:\Windows\System32\audiodg.exe
        - ProcessName: C:\Windows\System32\svchost.exe
        - ProcessName: C:\Windows\System32\mmc.exe
        - ProcessName: C:\Windows\System32\net.exe
        - ProcessName: C:\Windows\explorer.exe
        - ProcessName: C:\Windows\System32\SettingSyncHost.exe
        - ProcessName: C:\Windows\System32\sdiagnhost.exe
        - ProcessName|startswith: C:\Program Files
        - SubjectUserName: LOCAL SERVICE
    condition: selection and not filter
falsepositives:
    - normal system usage
tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.t1561
    - attack.impact
references:
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4673
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673
sample-evtx: ./sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx
ruletype: hayabusa