SIDs were filtered during authentication. Relevant for forest trust scenarios.
SID filtering bypasses are used in cross-forest privilege escalation attacks. If SID filtering is disabled between forests, attackers can inject SIDs for elevated access.
Alert: SID filtering events involving External SID or ForestSpecific trusts. Monitor trust configurations for SID filtering status.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4675 // SIDs were filtered
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4675
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# SIDs were filtered — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`SIDs were filtered. SIDs were filtered during authentication. Relevant for forest trust scenarios.
Event 4675 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Privilege Use' subcategory (Success and/or Failure).
Alert: SID filtering events involving External SID or ForestSpecific trusts. Monitor trust configurations for SID filtering status.