Is it possible to set up a Splunk alert for when a user receives Elevated Privileges (EP)?

New Member


I am trying to figure out a way to receive an alert (if possible) for when a user is granted elevated privileges.

0 Karma

Splunk Employee
Splunk Employee

Here is an example event returned from this search:

sourcetype="WinEventLog:Security" TokenElevationTypeDefault

05/12/2015 05:34:10 PM
SourceName=Microsoft Windows security auditing.
TaskCategory=Process Creation
Keywords=Audit Success
Message=A new process has been created.

    Security ID:        S-1-5-18
    Account Name:       WIN-L25DGSHI03K$
    Account Domain:     WORKGROUP
    Logon ID:       0x3e7

Process Information:
    New Process ID:     0x7f4
    New Process Name:   C:\Program Files\Splunk\bin\splunk-optimize.exe
    Token Elevation Type:   TokenElevationTypeDefault (1)
    Creator Process ID: 0x74c

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.

To set up an alert for this kind of event, check out this link.

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...