Transient Privilege Abuse - User Rights Granted and Quickly Revoked

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

Detects cases where a user privilege is granted (EventCode 4717) and subsequently revoked (EventCode 4718) within a 60-minute window. This behavior often indicates transient privilege abuse, where an attacker grants themselves temporary elevated rights to perform an action and then revokes them to evade detection or minimize their footprint.