How to generate a search that will show standard user accounts that escalate to administrator?

[rodiers01]

Good afternoon all. After an attacker gathers the login credentials for a standard user account they will want to elevate those same credentials to become an administrator. I'm looking to see if there's a search that I can run which will look for something like that? I'd like to generate an e-mail alert.

I have the following set-up below...

Cisco Security Suite, IIS Logging, Splunk App for Web Analytics, MS Windows AD Objects, Splunk App for Windows Infrastructure, Splunk Support for Active Directory.

Thanks folks.

[woodcock]

Start here:

... EventCode=4728 OR EventCode=4732