4656 Security log · Object Access medium severity very-high volume

Windows Event ID 4656 — A handle to an object was requested

Handle request for an audited object (file, registry, SAM). ObjectName and AccessList are key. Only generates when SACL is configured on target object.

Why event 4656 matters

SAM database access (ObjectName=\SAM) = credential dumping. LSASS process handle = memory dumping (Mimikatz, ProcDump). SECURITY hive access = credential harvesting. Requires SACL on target objects.

How to detect it

Alert: ObjectName contains SAM, lsass, or SECURITY hive path. Alert: AccessList contains Generic Read/Write on sensitive objects. Requires SACL configuration — not generated by default. Scope SACLs carefully to avoid volume explosion.

Log source
Security
Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access OS Credential Dumping (T1003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4656   // A handle to an object was requested
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4656
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A handle to an object was requested — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4656 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Object Access events

4657 A registry value was modified 4658 The handle to an object was closed 4660 An object was deleted 4663 An attempt was made to access an object 4665 An attempt was made to create an application client context 4670 Permissions on an object were changed 4690 An attempt was made to duplicate a handle to an object 4985 The state of a transaction has changed 5140 A network share object was accessed 5142 A network share object was added 5143 A network share object was modified 5144 A network share object was deleted

Frequently asked questions

What is Windows Event ID 4656?

A handle to an object was requested. Handle request for an audited object (file, registry, SAM). ObjectName and AccessList are key. Only generates when SACL is configured on target object.

Which log records event 4656?

Event 4656 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4656?

Event 4656 is associated with: OS Credential Dumping (T1003).

How do you detect activity around event 4656?

Alert: ObjectName contains SAM, lsass, or SECURITY hive path. Alert: AccessList contains Generic Read/Write on sensitive objects. Requires SACL configuration — not generated by default. Scope SACLs carefully to avoid volume explosion.