Repeated Privilege Use for Access Check

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•5

This rule detects repeated attempts to use privileges for access checks (EventID 4673) by a single user within a one-hour window, excluding the 'SeTrustedCredentialManagerAccessPrivilege'. A high count of such events (5 or more) could indicate an attempt at privilege escalation or unusual system access behavior.