Failed Call to LsaRegisterLogonProcess Privileged Service
This rule detects failed attempts by a user or process to call the 'LsaRegisterLogonProcess' function. This function requires the 'SeTcbPrivilege' privilege, which is typically held by legitimate logon processes. A failure to call this function, especially when combined with the '0x8010000000000000' keyword indicating a failure, could suggest an attacker (e.g., using tools like Rubeus) is attempting to interact with the Local Security Authority (LSA) to gain unauthorized access to credentials or perform other malicious activities. The rule specifically looks for Event ID 4673 (A privileged service was called) where the service is 'LsaRegisterLogonProcess()' and the operation failed.
Sigma
