SOC Event Lookup
Event ID 4663ObjectAccessP2

Windows Event ID 4663: An attempt was made to access an object

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4663 records access to an audited file, registry key, or other securable object.

Technical Metadata

Technical metadata for Event ID 4663
Event ID4663
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0009 Collection / T1005 Data from Local System
Key fields to watchObject Name, Access Mask, Process Name

Trigger Scenarios

It fires only when the target has an SACL and the requested access matches the audit policy.

Key Fields

Object Name

The audited file or registry path.

Access Mask

0x2 is write data, 0x10000 is DELETE, and 0x40000 is WRITE_DAC; interpret it with Object Type.

Process Name

The process requesting access, essential for distinguishing users from tools.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4663
SecurityEvent
| where EventID == 4663
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4663
index=wineventlog source="WinEventLog:Security" EventCode=4663
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4663
dataset = microsoft_windows_raw
| filter edr_event_id = 4663
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4663
title: Windows Security Event ID 4663
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
AccessMask0x1For file objects, the requested access includes ReadData/ListDirectory.Reading a sensitive local file supports collection triage when the process, account, and object are unexpected; the mask alone is common and benign in many workflows. Source
AccessMask0x2For file objects, the requested access includes WriteData/AddFile.Unexpected writes to protected or monitored data can indicate staging, tampering, or ransomware and require object-specific context. Source
AccessMask0x10000DELETE access was requested for the object.High-volume delete access against monitored files can support destructive-action or cleanup investigation when correlated with the responsible process. Source

MITRE ATT&CK Mapping

  • T1005Data from Local System

Detection Notes

Use 4663 for T1005 Data from Local System only when ObjectType and ObjectName identify sensitive local data and AccessMask includes 0x1 ReadData from an unexpected ProcessName. AccessMask 0x2 indicates writes and 0x10000 indicates delete access for file objects; retain ObjectType because the same bit can have different meanings for other object classes, then join ProcessId to 4688.

Common False Positives

  • File servers and applications create substantial expected access noise.
  • Backup and antivirus products request broad rights.

Related Events

Sample Log

Sanitized event sample
Object Name: C:\Finance\payroll.xlsx
Access Mask: 0x1
Process Name: C:\Windows\System32\cmd.exe

Frequently Asked Questions

What does Windows Event ID 4663 mean?

Event ID 4663 records that a process used an access right on an audited object, such as a file, registry key, kernel object, or Active Directory object.

Does AccessMask 0x1 always mean file read?

No. Access-mask meanings depend on ObjectType; for file objects 0x1 is ReadData/ListDirectory, so detection must retain the object type and requested-access text.

Why can Event ID 4663 be high volume?

Broad object SACLs can audit routine reads and writes; scope auditing to high-value objects and baseline approved processes and accounts.

Sources