Data Source: Windows Event Log Security 4662

Created: 2024-05-22

Last Updated: 2026-10-14

ID: f3c2cd64-0b5f-4013-8201-35dc03828ec6

Author: Patrick Bareiss, Splunk

Description

Logs an event when a user accessed an object within the Active Directory, such as creating, modifying, or deleting it

Details

Property	Value
Source	`XmlWinEventLog:Security`
Sourcetype	`XmlWinEventLog`
Separator	EventCode

Name ▲▼	Technique ▲▼	Type ▲▼
Windows AD Replication Request Initiated from Unsanctioned Location	DCSync	TTP
Windows AD Replication Request Initiated by User Account	DCSync	TTP
Windows AD Abnormal Object Access Activity	Domain Account	Anomaly
Windows Kerberos Coercion via DNS	DNS, Forced Authentication, Name Resolution Poisoning and SMB Relay	TTP
Windows AD Privileged Object Access Activity	Domain Account	TTP

Supported Apps

Splunk Add-on for Microsoft Windows (version 11.0.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">AccessList</span>
  
  <span class="pill kill-chain">AccessMask</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">ActivityID</span>
  
  <span class="pill kill-chain">AdditionalInfo</span>
  
  <span class="pill kill-chain">AdditionalInfo2</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">Caller_Domain</span>
  
  <span class="pill kill-chain">Caller_User_Name</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_nt_domain</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">Error_Code</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">event_time</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">HandleId</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">Logon_ID</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">name</span>
  
  <span class="pill kill-chain">object_file_name</span>
  
  <span class="pill kill-chain">object_file_path</span>
  
  <span class="pill kill-chain">ObjectName</span>
  
  <span class="pill kill-chain">ObjectServer</span>
  
  <span class="pill kill-chain">ObjectType</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">OperationType</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">Properties</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">session_id</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">severity_id</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src_nt_domain</span>
  
  <span class="pill kill-chain">src_user</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">subject</span>
  
  <span class="pill kill-chain">SubjectDomainName</span>
  
  <span class="pill kill-chain">SubjectLogonId</span>
  
  <span class="pill kill-chain">SubjectUserName</span>
  
  <span class="pill kill-chain">SubjectUserSid</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">ta_windows_action</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">TaskCategory</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">Version</span>
  
</div>

Example Log

 1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4662</EventID><Version>0</Version><Level>0</Level><Task>14080</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-01-05T06:17:11.064481600Z'/><EventRecordID>15110554</EventRecordID><Correlation ActivityID='{C46FD4F7-3F7F-0000-01D5-6FC47F3FDA01}'/><Execution ProcessID='612' ThreadID='4968'/><Channel>Security</Channel><Computer>ar-win-dc.attackrange.local</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-21-390003789-444691441-1275789787-1008</Data><Data Name='SubjectUserName'>AR-WIN-DC$</Data><Data Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0x335045</Data><Data Name='ObjectServer'>DS</Data><Data Name='ObjectType'>%{bf967a86-0de6-11d0-a285-00aa003049e2}</Data><Data Name='ObjectName'>%{94d92973-5ce1-4126-87d3-e2efaa3ceaec}</Data><Data Name='OperationType'>Object Access</Data><Data Name='HandleId'>0x0</Data><Data Name='AccessList'>%%7684
 2                </Data><Data Name='AccessMask'>0x10</Data><Data Name='Properties'>%%7684
 3        {59ba2f42-79a2-11d0-9020-00c04fc2d3cf}
 4            {bf967a00-0de6-11d0-a285-00aa003049e2}
 5        {e48d0154-bcf8-11d1-8702-00c04fb96050}
 6            {26d97369-6070-11d1-a9c6-0000f80367c1}
 7        {4c164200-20c0-11d0-a768-00aa006e0529}
 8            {bf967a68-0de6-11d0-a285-00aa003049e2}
 9    {bf967a86-0de6-11d0-a285-00aa003049e2}
10</Data><Data Name='AdditionalInfo'>-</Data><Data Name='AdditionalInfo2'></Data></EventData></Event>

Required Output Fields

dest

Source: GitHub | Version: 5