Get-WinEvent 4672 special privileges

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4672}

Query event 4672 (special privileges assigned to a logon) to detect accounts logging on with administrative privileges.

Run it when you want to know which accounts and processes are obtaining special privileges on your hosts: 4672 is generated on every logon that receives privileges like SeDebugPrivilege, SeBackupPrivilege, or SeTakeOwnershipPrivilege — exactly the ones abused by escalation and dumping tools. The base query gives you an inventory of privileged logons; filtered by account or host, it answers 'who is logging on with debug rights?' and 'from where?'. It's the context piece that turns any 4624 into a high-risk logon, and the basis for detecting service accounts with excessive privileges.

Don't use it as a standalone attack detection: 4672 is generated on every legitimate admin logon — on a host with active admins, the volume is high and the unfiltered query is noise. Filter by the privileges that really matter (SeDebugPrivilege, SeBackupPrivilege) or by service accounts (those that shouldn't log on with privileges). And watch the detail: the event lists the logon's privileges, but not all privileges are dangerous — SeChangeNotifyPrivilege appears on all logons. The query gains value when combined with 4624 (for logon type) and 4672 (for privileges).