Failed attempt to perform a privileged operation." event on daily basics,

[Chetan Hiremath]

Hello Team 

I am receiving several count of "Failed attempt to perform a privileged operation." event on daily basics,

Message I am getting in the log.

A privileged service was called. Subject: Security ID: S-1-5-21-1106476451-4122483766-1007359441-1023 Account Name: SPP00018 Account Domain: SP-JUMP Logon ID: 0x2456776F Service: Server: Security Service Name: - Process: Process ID: 0x28c4 Process Name: C:\Windows\explorer.exe Service Request Information: Privileges: SeTcbPrivilege"

Kindly help me to understand why this events are getting generated ?

[Eduardo Leon Aldazoro]

Hi Chetan Thanks for using Wazuh!

Can you please provide me with the following data:

- data.win.system.severityValue - data.win.system.eventID
-rule.groups -data.win.system.providerName
- data.win.system.level

I'll be waiting for you to reply.

Thank you.

Best Regards,

[Chetan Hiremath]

Hello Eduardo,
Sorry for the delay 

  data.win.system.severityValue - Audit-Failure.  data.win.system.eventID - 4673
rule.groups - windows, windows security data.win.system.providerName - Microsoft-windows-Security-auditing
data.win.system.level - 0

[Abdulaziz Aljaberi]

Dear  Eduardo Leon Aldazoro, 

I'm facing the same issue, and below are the details requested from your side. 

data.win.eventdata.privilegeList: SeProfileSingleProcessPrivilege

data.win.eventdata.processId: 0x3988

data.win.eventdata.processName:  C:\\Users\\m.aldakheel\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe

  

data.win.system.severityValue: AUDIT_FAILURE

data.win.system.eventID: 4673

data.win.system.providerName: Microsoft-Windows-Security-Auditing

rule.groups: windows, windows_security

data.win.system.level: 0

  

can anyone please help us solve this issue?