Windows Security 4673: Failed LsaRegisterLogonProcess Handle Registration

Alerts on failed attempts to call LsaRegisterLogonProcess() in Windows Security (Event 4673), tied to the SeTcbPrivilege requirement.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security events where a process attempts to call LsaRegisterLogonProcess() and the operation fails (Keywords indicate failure). Attackers may probe for access to LSA-related functionality to support credential access or lateral movement paths, including attempts to interact with logon-process registration mechanisms. Telemetry relies on EventID 4673 from the Windows Security log with the specified service name and failure keyword value.

Reporting behind it

Related detections9 linkedT1558.003 — drag to rearrange

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

Suspicious Kerberoasting via setspn Service Principal Query

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

Possible Targeted Kerberoasting via servicePrincipalName Modification

Suspicious SQL Service Principal Name Enumeration via Setspn

Windows: Suspicious Kerberos Ticket Requests from PowerShell Using KerberosRequestorSecurityToken

Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Windows Security 4673: Failed LsaRegisterLogonProcess Handle Registration

Pivot detection · T1558.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-failed-lsaregisterlogonprocess-service-call-setcbprivilege-chec-6daac7fc

title: "Windows Security 4673: Failed LsaRegisterLogonProcess Handle Registration"
id: 119f4577-0273-4509-b02e-7e770e6e1e66
status: test
description: This rule flags Windows Security events where a process attempts to call LsaRegisterLogonProcess() and the operation fails (Keywords indicate failure). Attackers may probe for access to LSA-related functionality to support credential access or lateral movement paths, including attempts to interact with logon-process registration mechanisms. Telemetry relies on EventID 4673 from the Windows Security log with the specified service name and failure keyword value.
references:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml
author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4673
    Service: LsaRegisterLogonProcess()
    Keywords: "0x8010000000000000"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL