4661 Security log · DS Access medium severity high volume

Windows Event ID 4661 — A handle to an object was requested (SAM / DS object)

A handle was requested to a securable object such as a SAM account database object or an Active Directory object. Records the Object Type, Object Name and the accesses requested.

Why event 4661 matters

4661 to SAM or directory-service objects underpins credential-dumping and enumeration detection. Handle requests to the SAM database or to sensitive AD objects can indicate secretsdump-style activity or targeted recon. Very high volume — it must be filtered by object type and requested accesses to be useful.

How to detect it

Focus on ObjectType SAM_* and DS objects where the requested Accesses include reads of credential attributes. Correlate with 4662 (DS object operation) and 4663 (object access). Baseline heavily before alerting.

Log source
Security
Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameObjectNameObjectTypeAccessMask

MITRE ATT&CK mapping

Tactic Technique
Credential Access OS Credential Dumping (T1003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Handle Requested To SAM Or DS Object
status: experimental
logsource:
  product: windows
  service: security
detection:
  sel:
    EventID: 4661
  obj:
    ObjectType|startswith: 'SAM_'
  condition: sel and obj
level: medium
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4661   // A handle to an object was requested (SAM / DS object)
| project TimeGenerated, Computer, SubjectUserName, ObjectName, ObjectType, AccessMask
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4661
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A handle to an object was requested (SAM / DS object) — add EventData fields: SubjectUserName, ObjectName, ObjectType, AccessMask`
Hunt event 4661 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related DS Access events

4662 An operation was performed on an object 4928 An Active Directory replica source naming context was established 4929 An Active Directory replica source naming context was removed 4930 An Active Directory replica source naming context was modified 4932 Synchronization of a replica of an Active Directory naming context has begun 4933 Synchronization of a replica of an Active Directory naming context has ended 4934 Attributes of an Active Directory object were replicated 4935 Replication failure begins 4936 Replication failure ends 4937 A lingering object was removed from the replica 5136 A directory service object was modified 5137 A directory service object was created

Frequently asked questions

What is Windows Event ID 4661?

A handle to an object was requested (SAM / DS object). A handle was requested to a securable object such as a SAM account database object or an Active Directory object. Records the Object Type, Object Name and the accesses requested.

Which log records event 4661?

Event 4661 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4661?

Event 4661 is associated with: OS Credential Dumping (T1003).

How do you detect activity around event 4661?

Focus on ObjectType SAM_* and DS objects where the requested Accesses include reads of credential attributes. Correlate with 4662 (DS object operation) and 4663 (object access). Baseline heavily before alerting.