Windows Event ID 4670 — Permissions on an object were changed — SecOps Tools

Why event 4670 matters

Attackers may weaken permissions on sensitive files or registry keys to allow later access with lower-privilege accounts. Also used to grant access to backdoor accounts.

How to detect it

Alert: permission changes on sensitive paths (SAM hive, security tool directories, backup directories). Alert: permission grant to non-admin accounts on sensitive objects.

Log source

Security

Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	File and Directory Permissions Modification (T1222)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 4670   // Permissions on an object were changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=4670
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Permissions on an object were changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4670 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Object Access events

4656 A handle to an object was requested 4657 A registry value was modified 4658 The handle to an object was closed 4660 An object was deleted 4663 An attempt was made to access an object 4665 An attempt was made to create an application client context 4690 An attempt was made to duplicate a handle to an object 4985 The state of a transaction has changed 5140 A network share object was accessed 5142 A network share object was added 5143 A network share object was modified 5144 A network share object was deleted

Frequently asked questions

What is Windows Event ID 4670?

Permissions on an object were changed. Permissions (DACL) modified on an audited object. ObjectName and new permissions are logged.

Which log records event 4670?

Event 4670 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Object Access' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4670?

Event 4670 is associated with: File and Directory Permissions Modification (T1222).

How do you detect activity around event 4670?

Alert: permission changes on sensitive paths (SAM hive, security tool directories, backup directories). Alert: permission grant to non-admin accounts on sensitive objects.