Breadcrumbs

EVID 4656...4691 : Object Access (Part 1) (XML - Security)

Event Details

Event Type

Audit File System, Audit Kernel Object, Audit Registry, and Audit Removable Storage

Event Description

  • 4656(S, F) : A handle to an object was requested.

  • 4658(S)

    : The handle to an object was closed.

  • 4660(S)

    : An object was deleted.

  • 4661(S, F) : A handle to an object was requested.

  • 4663(S)

    : An attempt was made to access an object.

  • 4670(S)

    : Permissions on an object were changed.

  • 4691(S) : Indirect access to an object was requested.

Event IDs

4656, 4658, 4660, 4661, 4663, 4670, 4691

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

N/A

N/A

Level

<severity>

<severity>

Task

<vendorinfo>, <subject>

<vendorinfo>

Opcode

N/A

N/A

Keywords

<tag1>

<result>, <tag1>

TimeCreated

N/A

N/A

EventRecordID

N/A

N/A

Correlation

N/A

N/A

Execution

N/A

N/A

Channel

N/A

N/A

Computer

<dname>

<dname>

SubjectUserSid

N/A

N/A

SubjectUserName

<login>

<login>

SubjectDomainName

<domain>

<domainorigin>

SubjectLogonId

<session>

<session>

ObjectServer

N/A

<object>

ObjectType

<object>, <tag2>

<objecttype>

ObjectName

<objectname>

<objectname>

HandleId

N/A

N/A

TransactionId

N/A

N/A

AccessList

<command>, <tag2>

<subject>

AccessReason

N/A

N/A

AccessMask

<status>

<status>

PrivilegeList

N/A

N/A

RestrictedSidCount

N/A

N/A

ProcessId

<processid>

<processid>

ProcessName

<process>

<process>

ResourceAttributes

N/A

N/A

OperationType

<tag2>

N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Event

Classification

1007793

Object Access

Base Rule

Object Accessed

Access Success

EVID 4662 : Operation Performed On Object Failed

Sub Rule

Access Object Failure

Access Failure

EVID 4658 : Handle To An Object Closed

Sub Rule

Object Handle Closed

Other Audit Success

EVID 4691 : Indirect Access To An Object Requested

Sub Rule

Object Accessed

Access Success

EVID 4690 : Attempt Made To Duplicate Object Handle

Sub Rule

Handle Duplicated

Information

EVID 4661 : Handle To An Object Was Requested

Sub Rule

Object Handle Requested

Other Audit Success

EVID 4985 : State Of Transaction Changed

Sub Rule

Transaction State Change

Network Traffic

EVID 4685 : State Of Transaction Changed

Sub Rule

Transaction State Change

Network Traffic

EVID 4670 : Permissions On Object Changed

Sub Rule

Policy Modified : Object

Policy

EVID 4663 : Attempt Made To Access Object

Sub Rule

Object Accessed

Access Success

EVID 4662 : Operation Performed On Object

Sub Rule

Command Executed

Access Success

EVID 4660 : Object Deleted

Sub Rule

Object Deleted/Removed

Access Success

EVID 4658 : Handle To An Object Closed

Sub Rule

Object Handle Closed

Other Audit Success

EVID 4657 : Registry Value Modified

Sub Rule

Object Modified

Access Success

EVID 4656 : Object Open Failed

Sub Rule

Access Object Failure

Access Failure

EVID 4656 : Object Opened

Sub Rule

Object Read

Access Success

EVID 4663 : Read Data

Sub Rule

Object Read

Access Success

EVID 4663 : Write Data

Sub Rule

Object Modified

Access Success

EVID 4663 : Append Data

Sub Rule

Object Modified

Access Success

EVID 4663 : Read EA

Sub Rule

Object Read

Access Success

EVID 4663 : Write EA

Sub Rule

Object Modified

Access Success

EVID 4663 : Execute/Traverse

Sub Rule

Access Granted Activity

Access Granted

EVID 4663 : Delete Child

Sub Rule

Object Deleted/Removed

Access Success

EVID 4663 : Read Attributes

Sub Rule

Object Read

Access Success

EVID 4663 : Write Attributes

Sub Rule

Object Modified

Access Success

EVID 4663 : DELETE

Sub Rule

Object Deleted/Removed

Access Success

EVID 4663 : READ_CONTROL

Sub Rule

Object Read

Access Success

EVID 4663 : WRITE_DAC

Sub Rule

Object Modified

Access Success

EVID 4663 : WRITE_OWNER

Sub Rule

Object Modified

Access Success

EVID 4663 : SYNCHRONIZE

Sub Rule

Object Modified

Access Success

EVID 4663 : ACCESS_SYS_SEC

Sub Rule

Object Modified

Access Success

EVID 4657 : Registry Value Created

Sub Rule

Object Created

Access Success

EVID 4657 : Registry Value Deleted

Sub Rule

Object Deleted/Removed

Access Success

EVID 4657 : Registry Value Modified

Sub Rule

Object Modified

Access Success

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Common Event

Classification

1011145

V 2.0 : Object Access Events

Base Rule

General Audit Message

Other Audit

V 2.0 : EVID 4656 : Object Handle Opened

Sub Rule

Object Accessed

Access Success

V 2.0 : EVID 4656 : Failed To Open Object

Sub Rule

Access Object Failure

Access Failure

V 2.0 : EVID 4658 : Object Handle Closed

Sub Rule

Object Handle Closed

Other Audit Success

V 2.0 : EVID 4660 : Object Deleted

Sub Rule

Object Deleted/Removed

Access Success

V 2.0 : EVID 4661 : Object Handle Opened

Sub Rule

Object Accessed

Access Success

V 2.0 : EVID 4661 : Failed To Open Object

Sub Rule

Access Object Failure

Access Failure

V 2.0 : EVID 4663 : Operation Performed On Object

Sub Rule

Object Accessed

Access Success

V 2.0 : EVID 4670 : Object Permissions Changed

Sub Rule

Policy Modified : Object

Policy

V 2.0 : EVID 4818 : Central Access Policy Difference

Sub Rule

Object Operation

Other Audit Success

V 2.0 : EVID 4691 : ALPC Port Accessed

Sub Rule

Object Accessed

Access Success

V 2.0 : EVID 4656 : Object Handle Opened

Sub Rule

Object Accessed

Access Success

V 2.0 : EVID 4656 : Failed To Open Object

Sub Rule

Access Object Failure

Access Failure

V 2.0 : EVID 4659 : Object Open for Deletion

Sub Rule

Object Accessed

Access Success