https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection simplifies and expands Microsoft security capabilities by consolidating data and functionality into unified experienc...
Updated Jun 04, 2021
Version 3.0
Blog Post
The following is not advanced hunting,
but a simple query I use to detect threats to LSA.
SELECT e1.TimeCreated AS Event4648_TimeCreated,
e1.ProcessName AS Event4648_ProcessName,
e2.TimeCreated AS Event4672_TimeCreated,
e2.SubjectUserSid,
e2.SubjectUserName,
e2.PrivilegeList,
e2.Computer
FROM EventTable e1
JOIN EventTable e2 ON e2.SubjectUserSid = e1.SubjectUserSid
WHERE e1.EventID = 4648
AND e1.TimeCreated >= DATE_SUB(NOW(), INTERVAL 24 HOUR)
AND e1.ProcessName NOT LIKE '%\\Windows\\System32\\%'
AND e1.ProcessName NOT LIKE '%\\Windows\\System\\%'
AND e1.ProcessName NOT LIKE '%\\Program Files\\%'
AND e1.ProcessName NOT LIKE '%\\Program Files (x86)\\%'
AND e2.EventID = 4672
AND e2.TimeCreated >= e1.TimeCreated
AND e2.TimeCreated <= DATE_ADD(e1.TimeCreated, INTERVAL 1 HOUR)
AND (
e2.PrivilegeList LIKE '%SeDebugPrivilege%'
OR e2.PrivilegeList LIKE '%SeAssignPrimaryTokenPrivilege%'
OR e2.PrivilegeList LIKE '%SeImpersonatePrivilege%'
);