User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Title: User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'
Status: test
Description:The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.
References:
  -https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
Author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community
Date: 2019-10-24
modified:2022-12-25
Tags:

• -'attack.credential-access'
• -'attack.lateral-movement'
• -'attack.privilege-escalation'
• -'attack.t1558.003'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4673'
    Service: 'LsaRegisterLogonProcess()'
    Keywords: '0x8010000000000000'
  condition:selection
Falsepositives:
  -Unknown
Level: high