Nicola Delfino • 9/24/2024

How to intercept the “run as administrator” event

Read Original

This article provides a detailed tutorial on how to detect when a user executes a program with 'Run as Administrator' on Windows. It explains monitoring Event ID 4688, checking the Token Elevation Type field for value %%1937, enabling the necessary audit policy, and using specific XPath queries for filtering in Windows Event Viewer and Azure Data Collection Rules.

0 comments
#Windows Security #Event Monitoring #Process Creation
How to intercept the “run as administrator” event

Comments

No comments yet

Be the first to share your thoughts!

Browser Extension

Get instant access to AllDevBlogs from your browser

Top of the Week

1
The Beautiful Web
Jens Oliver Meiert • 2 votes
2
When your coding agent doesn’t understand your project, you’ll get junk
Benjamin Cane • 1 votes
3
LLM Use in the Python Source Code
Miguel Grinberg • 1 votes
4
Wagon’s algorithm in Python
John D. Cook • 1 votes
5
An example conversation with Claude Code
Dumm Zeuch • 1 votes