Windows Security 4673: Failed LsaRegisterLogonProcess Handle Registration
Alerts on failed attempts to call LsaRegisterLogonProcess() in Windows Security (Event 4673), tied to the SeTcbPrivilege requirement.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security events where a process attempts to call LsaRegisterLogonProcess() and the operation fails (Keywords indicate failure). Attackers may probe for access to LSA-related functionality to support credential access or lateral movement paths, including attempts to interact with logon-process registration mechanisms. Telemetry relies on EventID 4673 from the Windows Security log with the specified service name and failure keyword value.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security 4673: Failed LsaRegisterLogonProcess Handle Registration"
id: 119f4577-0273-4509-b02e-7e770e6e1e66
status: test
description: This rule flags Windows Security events where a process attempts to call LsaRegisterLogonProcess() and the operation fails (Keywords indicate failure). Attackers may probe for access to LSA-related functionality to support credential access or lateral movement paths, including attempts to interact with logon-process registration mechanisms. Telemetry relies on EventID 4673 from the Windows Security log with the specified service name and failure keyword value.
references:
- https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml
author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-12-25
tags:
- attack.credential-access
- attack.lateral-movement
- attack.privilege-escalation
- attack.t1558.003
logsource:
product: windows
service: security
detection:
selection:
EventID: 4673
Service: LsaRegisterLogonProcess()
Keywords: "0x8010000000000000"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54
type: derived