Handle request for an audited object (file, registry, SAM). ObjectName and AccessList are key. Only generates when SACL is configured on target object.
SAM database access (ObjectName=\SAM) = credential dumping. LSASS process handle = memory dumping (Mimikatz, ProcDump). SECURITY hive access = credential harvesting. Requires SACL on target objects.
Alert: ObjectName contains SAM, lsass, or SECURITY hive path. Alert: AccessList contains Generic Read/Write on sensitive objects. Requires SACL configuration — not generated by default. Scope SACLs carefully to avoid volume explosion.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Credential Access | OS Credential Dumping (T1003) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4656 // A handle to an object was requested
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4656
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A handle to an object was requested — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
A handle to an object was requested. Handle request for an audited object (file, registry, SAM). ObjectName and AccessList are key. Only generates when SACL is configured on target object.
Event 4656 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).
Event 4656 is associated with: OS Credential Dumping (T1003).
Alert: ObjectName contains SAM, lsass, or SECURITY hive path. Alert: AccessList contains Generic Read/Write on sensitive objects. Requires SACL configuration — not generated by default. Scope SACLs carefully to avoid volume explosion.