Event ID 4663: An attempt was made to access an object
Written when a file, folder or registry key that has auditing (a SACL) configured is accessed.
- Log
- Security
- Category
- Object access
Why it matters
- Useful for watching sensitive shares and files. Mass access or deletion in a short time can be ransomware or data theft.
- Very noisy if auditing is set broadly; scope SACLs to what matters.
What to check
Check Object Name, Accesses (read, write, delete), Process Name and the account.
How to turn it on
Advanced Audit Policy: Object Access > Audit File System or Audit Registry, plus SACLs on the objects to watch.
MITRE ATT&CK
- T1485 Data Destruction