Windows Event ID 4663 — Object Access Attempt
Logged when an attempt is made to access an audited object (file, folder, registry key, etc.). Requires SACL (System Access Control List) to be configured on the object.
MITRE ATT&CK
T1003 · OS Credential Dumping
Credential Access
Why It Matters
File auditing on sensitive directories (e.g. SAM database, LSASS dump paths, credential stores) can reveal data theft or credential dumping attempts.
Key Fields
Investigation Tips
- 1.Enable auditing on sensitive paths: C:\Windows\System32\config, LSASS memory, credential stores.
- 2.Access to ntds.dit or SYSTEM hive by non-backup processes indicates credential dumping.
Seeing Event ID 4663 in your own logs? Upload an .evtx file — EventPeeker flags object access attempt automatically, maps it to MITRE ATT&CK, and writes the triage report. No account, files auto-deleted.
Analyze my logs →Related Event IDs
Go deeper: the full Credential Dumping guide
Builds on this page with the attack chain, step-by-step investigation, immediate containment actions, KQL/Sigma detection queries, and an annotated example log.
Read the Credential Dumping guide →See Event ID 4663 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects object access attempt patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →