Sensitive Privilege SeEnableDelegationPrivilege assigned to a Useredit

Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user right" to a user. The SeEnableDelegationPrivilege "user right" enables computer and user accounts to be trusted for delegation. Attackers can abuse this right to compromise Active Directory accounts and elevate their privileges.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-windows.*
  • logs-system.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Credential Access

Version: 1

Added (Elastic Stack release): 8.1.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guideedit

## Config

The 'Audit Authorization Policy Change' logging policy must be configured for (Success, Failure).
Steps to implement the logging policy with Advanced Audit Configuration:

```
Computer Configuration >
Windows Settings >
Security Settings >
Advanced Audit Policy Configuration >
Audit Policies >
Policy Change >
Audit Authorization Policy Change (Success,Failure)
```

Rule queryedit

event.action: "Authorization Policy Change" and event.code:4704 and
winlog.event_data.PrivilegeList:"SeEnableDelegationPrivilege"

Threat mappingedit

Framework: MITRE ATT&CKTM