win:security 4663
An attempt was made to access an object.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit File System
- Audit category
- Object Access
- Audit subcategory
- Audit File System
- Tier, host type
- Minimum
- Techniques
- 52
- Rules depending on it
- Splunk 21, Sigma 19, Microsoft Sentinel 5
Why this tier
DISA STIG (server); DISA STIG (workstation)
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | DISA STIG (workstation) |
| Windows member server | Minimum | DISA STIG (server) |
| Windows domain controller | Minimum | DISA STIG (server) |
| Windows web server (IIS), internet-facing | Minimum | DISA STIG (server) |
Techniques it helps detect
- T1003 OS Credential Dumping
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1025 Data from Removable Media
- T1027.001 Binary Padding
- T1027.003 Steganography
- T1037.001 Logon Script (Windows)
- T1041 Exfiltration Over C2 Channel
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1056 Input Capture
- T1056.001 Keylogging
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1070.008 Clear Mailbox Data
- T1074 Data Staged
- T1074.001 Local Data Staging
- T1110.002 Password Cracking
- T1114.001 Local Email Collection
- T1125 Video Capture
- T1187 Forced Authentication
- T1199 Trusted Relationship
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1484 Domain or Tenant Policy Modification
- T1484.001 Group Policy Modification
- T1491 Defacement
- T1491.001 Internal Defacement
- T1491.002 External Defacement
- T1505.004 IIS Components
- T1553.005 Mark-of-the-Web Bypass
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1557 Adversary-in-the-Middle
- T1559 Inter-Process Communication
- T1559.001 Component Object Model
- T1559.002 Dynamic Data Exchange
- T1564.005 Hidden File System
- T1564.012 File/Path Exclusions
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1654 Log Enumeration
- T1679 Selective Exclusion
- T1700 AI-Enabled Exfiltration
Rules that depend on it
Splunk 21
- ConnectWise ScreenConnect Path Traversal Windows SACL
- Non Chrome Process Accessing Chrome Default Dir
- Non Firefox Process Access Firefox Profile Dir
- SAM Database File Access Attempt
- Windows Cloud Sensitive File Read Access By Uncommon Process
- Windows Credential Access From Browser Password Store
- Windows Credentials from Password Stores Chrome Extension Access
- Windows Credentials from Password Stores Chrome LocalState Access
- Windows Credentials from Password Stores Chrome Login Data Access
- Windows GrimResource - MMC Process Accessing APDS DLL
- Windows Hosts File Access
- Windows Increase in Group or Object Modification Activity
- Windows Non Discord App Access Discord LevelDB
- Windows Process Accessing Windows Recall Directory
- Windows Product Key Registry Query
- Windows Query Registry Browser List Application
- Windows Query Registry UnInstall Program List
- Windows Unsecured Outlook Credentials Access In Registry
- Windows Unusual FileZilla XML Config Access
- Windows Unusual Intelliform Storage Registry Access
- Windows WinSCP Configuration Security Access
Sigma 19
- Access To Browser Credential Files By Uncommon Applications - Security by Daniel Koifman (@Koifsec), Nasreddine Bencherchali
- Azure AD Health Monitoring Agent Registry Keys Access by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- Azure AD Health Service Agents Registry Keys Access by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
- BlueSky Ransomware Artefacts by j4son
- CVE-2023-23397 Exploitation Attempt by Robert Lee @quantum_cookie
- CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security by Matt Anderson, Caleb Stewart, Huntress
- File Access Of Signal Desktop Sensitive Data by Andreas Braathen (mnemonic.io)
- ISO Image Mounted by Syed Hasan (@syedhasan009)
- LSASS Access From Non System Account by Roberto Rodriguez @Cyb3rWard0g
- Potential Secure Deletion with SDelete by Thomas Patzke
- Potentially Suspicious AccessMask Requested From LSASS by Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)
- Processes Accessing the Microphone and Webcam by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- ScreenConnect User Database Modification - Security by Matt Anderson, Kris Luzadre, Andrew Schwartz, Huntress
- Service Registry Key Read Access Request by Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
- Suspicious Teams Application Related ObjectAcess Event by @SerkinValery
- SysKey Registry Keys Access by Roberto Rodriguez @Cyb3rWard0g
- Sysmon Channel Reference Deletion by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- WCE wceaux.dll Access by Thomas Patzke
- Windows Defender Exclusion Registry Key - Write Access Requested by @BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)
Microsoft Sentinel 5
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Object and data eventsAppendix B item 5(3) | Supports an activity | our analysis: object access on audited files and keys |
| OMB M-26-14: Data affectedAppendix B item 5(9) | Supports an activity | our analysis: object access with access mask |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000085 (workstation): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000090 (workstation): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000586 (workstation): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000589 (workstation): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000240 (server): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000250 (server): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000586 (server): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000085 (workstation): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000090 (workstation): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000581 (workstation): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000582 (workstation): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000586 (workstation): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000589 (workstation): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000240 (server): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000250 (server): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000586 (server): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000240 (server): Audit Removable Storage Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000250 (server): Audit Removable Storage Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000586 (server): Audit Registry Success |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: An attempt was made to access an object. |