Presented by
Randy Franklin Smith (UltimateWindowsSecurity.com)
Monitoring Privileged Accounts with Windows Security Log
About this talk
Hackers have determined a number of ways to harvest privileged account credentials and use them to infiltrate networks. This makes monitoring privileged account usage critical to reducing your organization’s cyber risk.
The good news is that Windows provides event ID 4672, which is logged whenever an account signs in with admin user rights.
Event ID 4672 contains valuable information, such as user name, computer name and privileges, and logon session ID. Administrative users will always have one or more of the rights that trigger event 4672.
In this webinar, Windows Security Expert, Randy Franklin Smith, provides free technical training on detecting compromised accounts and demonstrates how to sift through event 4672 details.
Register now to learn how to use Windows Security Log to monitor privileged access and threat hunt for suspicious logon sessions.
More from this channel
Upcoming talks (1)
On-demand talks (257)
Subscribers (76946)
LogRhythm helps security teams stop breaches by turning disconnected data and signals into trustworthy insights. From connecting the dots across diverse log and threat intelligence sources to using sophisticated machine learning that spots suspicious anomalies in network traffic and user behavior, LogRhythm accurately pinpoints cyberthreats and empowers professionals to respond with speed and efficiency.
With cloud-native and self-hosted deployment flexibility, out-of-the-box integrations, and advisory services, LogRhythm makes it easy to realize value quickly and adapt to an ever-evolving threat landscape. Together, LogRhythm and our customers confidently monitor, detect, investigate, and respond to cyberattacks. Learn more at logrhythm.com