Windows Event ID 4663 — Object Access Attempt
Logged when an attempt is made to access an audited object (file, folder, registry key, etc.). Requires SACL (System Access Control List) to be configured on the object.
MITRE ATT&CK
Technique
T1003 · OS Credential Dumping
Tactic
Credential Access
Why It Matters
File auditing on sensitive directories (e.g. SAM database, LSASS dump paths, credential stores) can reveal data theft or credential dumping attempts.
Key Fields
Object NameThe file or resource accessed
Access MaskWhat type of access was requested — 0x2 (write), 0x10000 (delete) are more sensitive than reads
Account NameWho accessed the object
Process NameWhat process performed the access
Investigation Tips
- 1.Enable auditing on sensitive paths: C:\Windows\System32\config, LSASS memory, credential stores.
- 2.Access to ntds.dit or SYSTEM hive by non-backup processes indicates credential dumping.
Go deeper: the full Credential Dumping guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Credential Dumping guide →See Event ID 4663 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →