win:security 4656
A handle to an object was requested.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit File System
- Audit category
- Object Access
- Audit subcategory
- Audit File System
- Tier, host type
- Minimum
- Techniques
- 52
- Rules depending on it
- Sigma 14, Elastic 1, Microsoft Sentinel 4
Why this tier
DISA STIG (server); DISA STIG (workstation)
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | DISA STIG (workstation) |
| Windows member server | Minimum | DISA STIG (server) |
| Windows domain controller | Minimum | DISA STIG (server) |
| Windows web server (IIS), internet-facing | Minimum | DISA STIG (server) |
Techniques it helps detect
- T1003 OS Credential Dumping
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1025 Data from Removable Media
- T1027.001 Binary Padding
- T1027.003 Steganography
- T1037.001 Logon Script (Windows)
- T1041 Exfiltration Over C2 Channel
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1056 Input Capture
- T1056.001 Keylogging
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1070.008 Clear Mailbox Data
- T1074 Data Staged
- T1074.001 Local Data Staging
- T1110.002 Password Cracking
- T1114.001 Local Email Collection
- T1125 Video Capture
- T1187 Forced Authentication
- T1199 Trusted Relationship
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1484 Domain or Tenant Policy Modification
- T1484.001 Group Policy Modification
- T1491 Defacement
- T1491.001 Internal Defacement
- T1491.002 External Defacement
- T1505.004 IIS Components
- T1553.005 Mark-of-the-Web Bypass
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1557 Adversary-in-the-Middle
- T1559 Inter-Process Communication
- T1559.001 Component Object Model
- T1559.002 Dynamic Data Exchange
- T1564.005 Hidden File System
- T1564.012 File/Path Exclusions
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1654 Log Enumeration
- T1679 Selective Exclusion
- T1700 AI-Enabled Exfiltration
Rules that depend on it
Sigma 14
- Azure AD Health Monitoring Agent Registry Keys Access by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- Azure AD Health Service Agents Registry Keys Access by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- BlueSky Ransomware Artefacts by j4son
- CVE-2023-23397 Exploitation Attempt by Robert Lee @quantum_cookie
- LSASS Access From Non System Account by Roberto Rodriguez @Cyb3rWard0g
- Password Dumper Activity on LSASS by sigma
- Potential Secure Deletion with SDelete by Thomas Patzke
- Potentially Suspicious AccessMask Requested From LSASS by Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)
- Processes Accessing the Microphone and Webcam by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- SAM Registry Hive Handle Request by Roberto Rodriguez @Cyb3rWard0g
- SCM Database Handle Failure by Roberto Rodriguez @Cyb3rWard0g
- SysKey Registry Keys Access by Roberto Rodriguez @Cyb3rWard0g
- WCE wceaux.dll Access by Thomas Patzke
- Windows Defender Exclusion Registry Key - Write Access Requested by @BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)
Elastic 1
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Object and data eventsAppendix B item 5(3) | Supports an activity | our analysis: handle requests on audited objects |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000085 (workstation): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000090 (workstation): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000586 (workstation): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000589 (workstation): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000240 (server): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000250 (server): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000586 (server): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000085 (workstation): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000090 (workstation): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000581 (workstation): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000582 (workstation): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000586 (workstation): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000589 (workstation): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000240 (server): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000250 (server): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000586 (server): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000240 (server): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000250 (server): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000586 (server): Audit Registry Success |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: A handle to an object was requested. |