Windows Event ID 4675: SIDs were filtered
- Applicable version
- Windows Server 2008 and later
- Last reviewed
- 2026-07-22
Quick summary
Windows Security Event ID 4675 records that SIDs were filtered for an Active Directory trust.
Technical Metadata
| Event ID | 4675 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| MITRE ATT&CK | TA0004 Privilege Escalation / T1134.005 Access Token Manipulation: SID-History Injection |
| Key fields to watch | Filtered SIDs, Trust Direction / Trust Attributes / Trust Type, TDO Domain SID |
Trigger Scenarios
The event is generated on a domain controller when SID filtering is applied for a specific trust and SIDs are removed from the authorization data.
Key Fields
Filtered SIDs
The SIDs removed by trust filtering. Unexpected privileged-domain SIDs in this field show that the trust boundary blocked attempted privilege projection.
Trust Direction / Trust Attributes / Trust Type
Trust metadata that identifies which relationship performed the filtering. Use it to determine whether the event belongs to an external, forest, or other configured trust.
TDO Domain SID
The trusted-domain object domain SID. It anchors the filtered SID list to the trust relationship being evaluated.
Threat Hunting Queries
SecurityEvent
| where EventID == 4675
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
index=wineventlog source="WinEventLog:Security" EventCode=4675
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 4675- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4675
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4675
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 4675 | Windows filtered SIDs during logon processing. | Interpret EventID with the complete event and correlated activity; this value alone is not proof of compromise. Source |
| FilteredSids | SID list | The SIDs removed by trust filtering and the primary value for determining risk. | Interpret FilteredSids with the complete event and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1134.005Access Token Manipulation: SID-History Injection
Detection Notes
Use threshold=1 for 4675 on high-value trusts because the event is already the domain controller reporting that SIDs were filtered. It supports T1134.005 triage when Filtered SIDs contains privileged or foreign-domain SIDHistory values, since SID-History Injection attempts to project extra SIDs into the token and trust SID filtering removes them. Correlate the same trust to recent 4765 or 4766 SID History changes and 4716 trust modifications before treating the event as malicious rather than expected boundary enforcement.
Common False Positives
- Normal SID filtering can occur on configured external or forest trusts and may simply confirm the trust boundary is working.
- Trust migrations and domain consolidation projects can produce expected filtering events.
Related Events
Sample Log
Target Account:
Account Name: alice
Trust Information:
Trust Direction: Inbound
Trust Attributes: FOREST_TRANSITIVE
Trust Type: Forest
TDO Domain SID: S-1-5-21-1000-2000-3000
Filtered SIDs: S-1-5-21-4000-5000-6000-512Frequently Asked Questions
What does Windows Event ID 4675 mean?
Windows filtered one or more SIDs during authentication across a trust boundary.
Does Event ID 4675 always indicate malicious activity?
No. SID filtering is a security control and may block expected legacy SIDHistory values.
How should Event ID 4675 be investigated?
Review FilteredSids and trust attributes and correlate with SIDHistory and trust-change events.
Sources
- 4675: SIDs were filtered
Microsoft · vendor
- Access Token Manipulation: SID-History Injection (T1134.005)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule