Windows Security: Failed LsaRegisterLogonProcess Service Call (SeTcbPrivilege Check)

Alerts on failed attempts to call LsaRegisterLogonProcess() in Windows Security (Event 4673), tied to the SeTcbPrivilege requirement.

FreeUnreviewedSigmahighv1

windows-security-failed-lsaregisterlogonprocess-service-call-setcbprivilege-chec-6daac7fc

title: "Windows Security: Failed LsaRegisterLogonProcess Service Call (SeTcbPrivilege Check)"
id: 119f4577-0273-4509-b02e-7e770e6e1e66
status: test
description: This rule flags Windows Security events (EventID 4673) where a caller attempts to invoke LsaRegisterLogonProcess() and the operation fails. The function enforces that the calling process is a logon process by requiring the SeTcbPrivilege privilege, so repeated or unexpected failures can indicate malicious attempts to obtain a handle to LSA. The detection relies on Security auditing telemetry capturing the service name and failure keywords for the attempted call.
references:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml
author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4673
    Service: LsaRegisterLogonProcess()
    Keywords: "0x8010000000000000"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54
    type: derived

What it detects

This rule flags Windows Security events (EventID 4673) where a caller attempts to invoke LsaRegisterLogonProcess() and the operation fails. The function enforces that the calling process is a logon process by requiring the SeTcbPrivilege privilege, so repeated or unexpected failures can indicate malicious attempts to obtain a handle to LSA. The detection relies on Security auditing telemetry capturing the service name and failure keywords for the attempted call.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.