SOC Event Lookup
Event ID 4670ObjectAccessP3

Windows Event ID 4670: Permissions on an object were changed

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4670 records that permissions on a file system, registry, or security token object changed.

Technical Metadata

Technical metadata for Event ID 4670
Event ID4670
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1222.001 File and Directory Permissions Modification
Key fields to watchObject Type / Object Name / Handle ID, OldSd / NewSd, Process ID / Process Name

Trigger Scenarios

Microsoft documents that this event is generated when object permissions change and that file/registry generation requires SACL auditing for Change Permissions, Take Ownership, Write DAC, or Write Owner.

Key Fields

Object Type / Object Name / Handle ID

Identifies the object whose permissions changed and provides a hexadecimal handle for correlation with 4663.

OldSd / NewSd

Original and new SDDL values. Microsoft documents rights such as FA, WD Modify Permissions, WO Modify Owner, and hex rights such as 0xf0007.

Process ID / Process Name

The process through which permissions were changed. Microsoft recommends monitoring processes outside standard folders or with restricted substrings.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4670
SecurityEvent
| where EventID == 4670
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4670
index=wineventlog source="WinEventLog:Security" EventCode=4670
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 4670
dataset = microsoft_windows_raw
| filter edr_event_id = 4670
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4670
title: Windows Security Event ID 4670
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4670
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
Object TypeFileThe object is a file or directory whose security descriptor changed.Interpret Object Type with the other documented fields and correlated events; this value alone is not proof of compromise. Source
NewSdSDDLThe new security descriptor can be compared with OldSd to identify added rights.Interpret NewSd with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1222.001File and Directory Permissions Modification

Detection Notes

Alert when Object Name is C:\Windows\System32, C:\ProgramData\, C:\Users\Public, or a critical registry key and NewSd adds WD (Everyone), grants FA, or includes owner/permission rights such as WO/WD/0xf0007 not present in OldSd. Microsoft documents Object Type, Object Name, OldSd/NewSd, and SDDL rights for 4670; broadening DACLs on executable or service paths supports T1222.001 File and Directory Permissions Modification. Correlate Handle ID with 4663 and Process ID with 4688.

Common False Positives

  • Installers and administrators legitimately update ACLs on application directories and registry keys.
  • Token-object 4670 events are often informational and hard to attribute, per Microsoft guidance.

Related Events

Sample Log

Sanitized event sample
EventID: 4670
Object Type: File
Object Name: C:\ProgramData\svc\agent.exe
Handle ID: 0x3f0
OldSd: D:(A;;FR;;;BU)
NewSd: D:(A;;FA;;;WD)
Process Name: C:\Windows\System32\icacls.exe

Frequently Asked Questions

What does Windows Event ID 4670 mean?

Permissions on an audited object changed.

Does Event ID 4670 always indicate malicious activity?

No. Administrators, installers, and policy systems legitimately update permissions.

How should Event ID 4670 be investigated?

Compare OldSd and NewSd, identify ObjectName and ObjectType, and correlate HandleId with 4663 and ProcessId with 4688.

Sources