win:security 4670
Permissions on an object were changed.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Object Access > Audit File System
- Audit category
- Object Access
- Audit subcategory
- Audit File System
- Tier, host type
- Minimum
- Techniques
- 53
- Rules depending on it
- Microsoft Sentinel 1
Why this tier
DISA STIG (server); DISA STIG (workstation)
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | DISA STIG (workstation) |
| Windows member server | Minimum | DISA STIG (server) |
| Windows domain controller | Minimum | DISA STIG (server) |
| Windows web server (IIS), internet-facing | Minimum | DISA STIG (server) |
Techniques it helps detect
- T1003 OS Credential Dumping
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1025 Data from Removable Media
- T1027.001 Binary Padding
- T1027.003 Steganography
- T1037.001 Logon Script (Windows)
- T1041 Exfiltration Over C2 Channel
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1056 Input Capture
- T1056.001 Keylogging
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1070.008 Clear Mailbox Data
- T1074 Data Staged
- T1074.001 Local Data Staging
- T1098 Account Manipulation
- T1110.002 Password Cracking
- T1114.001 Local Email Collection
- T1125 Video Capture
- T1187 Forced Authentication
- T1199 Trusted Relationship
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1484 Domain or Tenant Policy Modification
- T1484.001 Group Policy Modification
- T1491 Defacement
- T1491.001 Internal Defacement
- T1491.002 External Defacement
- T1505.004 IIS Components
- T1553.005 Mark-of-the-Web Bypass
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1557 Adversary-in-the-Middle
- T1559 Inter-Process Communication
- T1559.001 Component Object Model
- T1559.002 Dynamic Data Exchange
- T1564.005 Hidden File System
- T1564.012 File/Path Exclusions
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1654 Log Enumeration
- T1679 Selective Exclusion
- T1700 AI-Enabled Exfiltration
Rules that depend on it
Microsoft Sentinel 1
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Privilege changesAppendix B item 5(4) | Supports an activity | our analysis: permissions on an object changed |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000105 (workstation): Audit Authentication Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000107 (workstation): Audit Authorization Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000586 (workstation): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000589 (workstation): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000280 (server): Audit Authentication Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000290 (server): Audit Authorization Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11 | Names this event | WN22-AU-000586 (server): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000105 (workstation): Audit Authentication Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000107 (workstation): Audit Authorization Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000581 (workstation): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000582 (workstation): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000586 (workstation): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000589 (workstation): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000280 (server): Audit Authentication Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000290 (server): Audit Authorization Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10) | Names this event | WN19-AU-000586 (server): Audit Registry Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000280 (server): Audit Authentication Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000281 (server): Audit Authorization Policy Change Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000581 (server): Audit File System Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000582 (server): Audit File System Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000585 (server): Audit Registry Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27) | Names this event | WN25-AU-000586 (server): Audit Registry Success |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: Permissions on an object were changed. |