The AccessMask field in Microsoft-Windows-Security-Auditing events Event ID 4656: A handle to an object was requested, Event ID 4663: An attempt was made to access an object, Event ID 4661: A handle to an object was requested, and Event ID 4662: An operation was performed on an object is a hexadecimal bitmask whose meaning depends on the event: 4656 records requested rights, while 4663 records rights used on an object. The meaning of the object-specific bits varies by object type: the same bit value represents different rights for files, registry keys, AD objects, and SAM objects.
Event 4657 records a registry value change using fields such as ObjectValueName, OperationType, OldValue, and NewValue; its documented schema has no AccessMask. See Microsoft’s 4657 schema.
For the surrounding model, see Security Descriptors and Access Checks.
Standard and Generic Rights#
Standard rights describe operations shared by many object types; support depends on the object. Registry keys do not support SYNCHRONIZE. Generic rights map to rights for the particular object type. See standard rights and registry-key rights.
| Bit | Right | Description |
|---|---|---|
| 0x00010000 | DELETE | Delete the object |
| 0x00020000 | READ_CONTROL | Read the security descriptor except its SACL |
| 0x00040000 | WRITE_DAC | Modify the DACL: change who can access the object |
| 0x00080000 | WRITE_OWNER | Change the object owner |
| 0x00100000 | SYNCHRONIZE | Use the object for synchronization |
| 0x10000000 | GENERIC_ALL | Full control |
| 0x20000000 | GENERIC_EXECUTE | Execute access |
| 0x40000000 | GENERIC_WRITE | Write access |
| 0x80000000 | GENERIC_READ | Read access |
File and Directory Access Rights#
Microsoft-Windows-Security-Auditing Event ID 4656: A handle to an object was requested and Event ID 4663: An attempt was made to access an object: object access auditing for files and directories.
| Bit | Right | Description |
|---|---|---|
| 0x00000001 | FILE_READ_DATA / FILE_LIST_DIRECTORY | Read file contents or list directory |
| 0x00000002 | FILE_WRITE_DATA / FILE_ADD_FILE | Write to file or add a file to directory |
| 0x00000004 | FILE_APPEND_DATA / FILE_ADD_SUBDIRECTORY | Append data to file or create subdirectory |
| 0x00000008 | FILE_READ_EA | Read extended attributes |
| 0x00000010 | FILE_WRITE_EA | Write extended attributes |
| 0x00000020 | FILE_EXECUTE / FILE_TRAVERSE | Execute file or traverse directory |
| 0x00000040 | FILE_DELETE_CHILD | Delete a file or directory within a directory |
| 0x00000080 | FILE_READ_ATTRIBUTES | Read file attributes |
| 0x00000100 | FILE_WRITE_ATTRIBUTES | Write file attributes |
| 0x00010000 | DELETE | Delete the file or directory |
| 0x00020000 | READ_CONTROL | Read the security descriptor except its SACL |
Registry Key Access Rights#
Interpret registry-key rights in 4656 and 4663 with ObjectType=Key. A key’s DACL is distinct from the values stored beneath the key. Microsoft’s registry-key reference defines these rights and view-selection flags.
| Bit | Right | Description |
|---|---|---|
| 0x00000001 | KEY_QUERY_VALUE | Query registry key values |
| 0x00000002 | KEY_SET_VALUE | Set registry key values |
| 0x00000004 | KEY_CREATE_SUB_KEY | Create subkeys |
| 0x00000008 | KEY_ENUMERATE_SUB_KEYS | Enumerate subkeys |
| 0x00000010 | KEY_NOTIFY | Request change notifications |
| 0x00000020 | KEY_CREATE_LINK | Reserved for system use |
| 0x00000200 | KEY_WOW64_32KEY | Select the 32-bit registry view (flag, not a permission) |
| 0x00000100 | KEY_WOW64_64KEY | Select the 64-bit registry view (flag, not a permission) |
Active Directory Object Rights#
Microsoft-Windows-Security-Auditing Event ID 4662: An operation was performed on an object: an operation was performed on an Active Directory object.
| Bit | Right | Description |
|---|---|---|
| 0x00000001 | DS_CREATE_CHILD | Create child objects |
| 0x00000002 | DS_DELETE_CHILD | Delete child objects |
| 0x00000004 | DS_LIST_CONTENTS | List contents of the container |
| 0x00000008 | DS_WRITE_SELF | Write self (validated writes) |
| 0x00000010 | DS_READ_PROP | Read all properties |
| 0x00000020 | DS_WRITE_PROP | Write all properties |
| 0x00000040 | DS_DELETE_TREE | Delete the entire subtree |
| 0x00000080 | DS_LIST_OBJECT | List the object (visibility control) |
| 0x00000100 | DS_CONTROL_ACCESS | Extended rights (e.g. Replicating Directory Changes for DCSync) |
SAM Object Rights#
Microsoft-Windows-Security-Auditing Event ID 4661: A handle to an object was requested: a handle to a SAM object was requested.
| Bit | Right | Description |
|---|---|---|
| 0x00000001 | ReadPasswordParameters | Read password policy parameters |
| 0x00000002 | WritePasswordParameters | Write password policy parameters |
| 0x00000004 | ReadOtherParameters | Read other domain parameters |
| 0x00000008 | WriteOtherParameters | Write other domain parameters |
| 0x00000010 | CreateUser | Create user accounts |
| 0x00000020 | CreateGlobalGroup | Create global groups |
| 0x00000040 | CreateLocalGroup | Create local groups |
| 0x00000080 | GetLocalGroupMembership | Enumerate local group membership |
| 0x00000100 | ListAccounts | List all accounts in the domain |
| 0x00000200 | LookupIDs | Resolve names to SIDs |
| 0x00000400 | AdministerServer | Full administrative access to the SAM |
Commonly Monitored Access Patterns#
| Pattern | Interpretation | Detection |
|---|---|---|
DS_CONTROL_ACCESS (0x100) on domain root | DCSync (Replicating Directory Changes) | Event ID 4662: An operation was performed on an object with DS_CONTROL_ACCESS on the domain partition DN from non-DC accounts |
WRITE_DAC (0x40000) | Right to modify the DACL; not proof of an ACL backdoor | Event ID 4656: A handle to an object was requested/Event ID 4663: An attempt was made to access an object with WRITE_DAC by non-owner/non-admin principals |
WRITE_OWNER (0x80000) | Right to change ownership; not proof that ownership changed | Event ID 4656: A handle to an object was requested/Event ID 4663: An attempt was made to access an object from non-admin accounts |
GENERIC_ALL (0x10000000) | Full control requested | Unusual when targeting sensitive files, AD objects, or registry keys |
FILE_WRITE_DATA (0x2) on sensitive paths | File write access; additional context is needed to establish tampering | Event ID 4663: An attempt was made to access an object on security-relevant files (e.g. SAM, SYSTEM, SECURITY hives) |
KEY_SET_VALUE (0x2) on Run keys | Right to change a value; not proof of persistence | Event ID 4656/4663 with registry object type and this right; separately, 4657 can record the value change without an access-mask field |
A 4656 request does not establish later use; 4663 records use of a right. Neither a mask nor a rule match by itself establishes malicious intent. For a permission change, inspect 4670 and its old/new descriptors under the required audit configuration. Microsoft’s 4656 documentation and 4663 documentation distinguish requests from use.
Related Events#
- Microsoft-Windows-Security-Auditing Event ID 4656: A handle to an object was requested
- Microsoft-Windows-Security-Auditing Event ID 4663: An attempt was made to access an object
- Microsoft-Windows-Security-Auditing Event ID 4657: A registry value was modified
- Microsoft-Windows-Security-Auditing Event ID 4661: A handle to an object was requested (SAM)
- Microsoft-Windows-Security-Auditing Event ID 4662: An operation was performed on an object (AD)