detection.wiki

Microsoft-Windows-Security-Auditing › Event 4670

Event ID 4670 — Permissions on an object were changed.

Provider
Microsoft-Windows-Security-Auditing
Channel
Security
Audit Policy
Policy Change → Authentication Policy Change
Collection Priority
Recommended (Yamato Security, others)
Opcode
Info

Description

Permissions on an object were changed.

Message #

Permissions on an object were changed.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Object:
	Object Server: %5
	Object Type: %6
	Object Name: %7
	Handle ID: %8

Process:
	Process ID: %11
	Process Name: %12

Permissions Change:
	Original Security Descriptor: %9
	New Security Descriptor: %10

Fields #

NameDescription
SubjectUserSid SID[Subject] Security ID.
SubjectUserName UnicodeString[Subject] Account Name.
SubjectDomainName UnicodeString[Subject] Account Domain.
SubjectLogonId HexInt64[Subject] Logon ID.
ObjectServer UnicodeString[Object] Object Server.
ObjectType UnicodeString[Object] Object Type.
ObjectName UnicodeString[Object] Object Name.
HandleId Pointer[Object] Handle ID.
OldSd UnicodeString[Permissions Change] Original Security Descriptor.
NewSd UnicodeString[Permissions Change] New Security Descriptor.
ProcessId Pointer[Process] Process ID.
ProcessName UnicodeString[Process] Process Name.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4670,
    "version": 0,
    "level": 0,
    "task": 13570,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2023-11-06T02:03:41.603666+00:00",
    "event_record_id": 314599,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 21268
    },
    "channel": "Security",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-18",
    "SubjectUserName": "WINDEV2310EVAL$",
    "SubjectDomainName": "WORKGROUP",
    "SubjectLogonId": "0x3e7",
    "ObjectServer": "Security",
    "ObjectType": "Token",
    "ObjectName": "-",
    "HandleId": "0xddc",
    "OldSd": "D:(A;;GA;;;SY)(A;;GA;;;NS)",
    "NewSd": "D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)",
    "ProcessId": "0x30c",
    "ProcessName": "C:\\Windows\\System32\\services.exe"
  },
  "message": ""
}

Detection Patterns #

Community Notes #

Permissions on an object were changed, may detect ACL edits on files, registry, or tokens that grant elevated rights.

Binary Defense post Windows Defender ACL Blocking: A Silent Technique With Serious Impact — attackers can modify DACLs on the Windows Defender directory to block the antimalware service from reading its own binaries, silently disabling protection without triggering tamper alerts. Look for ACL changes targeting Defender paths (e.g. C:\ProgramData\Microsoft\Windows Defender\) paired with 4663 WRITE_DAC access.

References #