SOC Event Lookup
Event ID 4675KerberosP3

Windows Event ID 4675: SIDs were filtered

Applicable version
Windows Server 2008 and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4675 records that SIDs were filtered for an Active Directory trust.

Technical Metadata

Technical metadata for Event ID 4675
Event ID4675
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0004 Privilege Escalation / T1134.005 Access Token Manipulation: SID-History Injection
Key fields to watchFiltered SIDs, Trust Direction / Trust Attributes / Trust Type, TDO Domain SID

Trigger Scenarios

The event is generated on a domain controller when SID filtering is applied for a specific trust and SIDs are removed from the authorization data.

Key Fields

Filtered SIDs

The SIDs removed by trust filtering. Unexpected privileged-domain SIDs in this field show that the trust boundary blocked attempted privilege projection.

Trust Direction / Trust Attributes / Trust Type

Trust metadata that identifies which relationship performed the filtering. Use it to determine whether the event belongs to an external, forest, or other configured trust.

TDO Domain SID

The trusted-domain object domain SID. It anchors the filtered SID list to the trust relationship being evaluated.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4675
SecurityEvent
| where EventID == 4675
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4675
index=wineventlog source="WinEventLog:Security" EventCode=4675
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4675
dataset = microsoft_windows_raw
| filter edr_event_id = 4675
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4675
title: Windows Security Event ID 4675
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4675
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID4675Windows filtered SIDs during logon processing.Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source
FilteredSidsSID listThe SIDs removed by trust filtering and the primary value for determining risk.Interpret FilteredSids with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1134.005Access Token Manipulation: SID-History Injection

Detection Notes

Use threshold=1 for 4675 on high-value trusts because the event is already the domain controller reporting that SIDs were filtered. It supports T1134.005 triage when Filtered SIDs contains privileged or foreign-domain SIDHistory values, since SID-History Injection attempts to project extra SIDs into the token and trust SID filtering removes them. Correlate the same trust to recent 4765 or 4766 SID History changes and 4716 trust modifications before treating the event as malicious rather than expected boundary enforcement.

Common False Positives

  • Normal SID filtering can occur on configured external or forest trusts and may simply confirm the trust boundary is working.
  • Trust migrations and domain consolidation projects can produce expected filtering events.

Related Events

Sample Log

Sanitized event sample
Target Account:
  Account Name: alice
Trust Information:
  Trust Direction: Inbound
  Trust Attributes: FOREST_TRANSITIVE
  Trust Type: Forest
  TDO Domain SID: S-1-5-21-1000-2000-3000
  Filtered SIDs: S-1-5-21-4000-5000-6000-512

Frequently Asked Questions

What does Windows Event ID 4675 mean?

Windows filtered one or more SIDs during authentication across a trust boundary.

Does Event ID 4675 always indicate malicious activity?

No. SID filtering is a security control and may block expected legacy SIDHistory values.

How should Event ID 4675 be investigated?

Review FilteredSids and trust attributes and correlate with SIDHistory and trust-change events.

Sources