Windows Security: Detect SeEnableDelegationPrivilege Assigned via AD (Event ID 4704)

title: "Windows Security: Detect SeEnableDelegationPrivilege Assigned via AD (Event ID 4704)"
id: 68e04aa0-6b17-4cf9-8437-e12b4ee6d48d
status: test
description: This rule flags Windows Security events (Event ID 4704) where the privilege list includes SeEnableDelegationPrivilege. That user-right assignment can enable an account to manage or affect other Active Directory user objects, making it a high-impact privilege escalation and persistence vector. Telemetry relies on the Windows Security audit event that reports the assigned privileges for the user-right change.
references:
  - https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_active_directory_user_control.yml
author: "@neu5ron, Huntrule Team"
date: 2017-07-30
modified: 2021-12-02
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit Authorization Policy Change"
detection:
  selection_base:
    EventID: 4704
  selection_keywords:
    PrivilegeList|contains: SeEnableDelegationPrivilege
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 311b6ce2-7890-4383-a8c2-663a9f6b43cd
    type: derived