SOC Event Lookup
Event ID 4670ObjectAccessP3

Windows Event ID 4670: Permissions on an object were changed

Windows Security Event ID 4670 records that permissions on a file system, registry, or security token object changed.

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-13

Trigger Scenarios

Microsoft documents that this event is generated when object permissions change and that file/registry generation requires SACL auditing for Change Permissions, Take Ownership, Write DAC, or Write Owner.

Key Fields

Object Type / Object Name / Handle ID

Identifies the object whose permissions changed and provides a hexadecimal handle for correlation with 4663.

OldSd / NewSd

Original and new SDDL values. Microsoft documents rights such as FA, WD Modify Permissions, WO Modify Owner, and hex rights such as 0xf0007.

Process ID / Process Name

The process through which permissions were changed. Microsoft recommends monitoring processes outside standard folders or with restricted substrings.

Common False Positives

  • Installers and administrators legitimately update ACLs on application directories and registry keys.
  • Token-object 4670 events are often informational and hard to attribute, per Microsoft guidance.

Related Events

MITRE ATT&CK Mapping

  • T1222.001File and Directory Permissions Modification

Detection Notes

Alert when Object Name is C:\Windows\System32, C:\ProgramData\, C:\Users\Public, or a critical registry key and NewSd adds WD (Everyone), grants FA, or includes owner/permission rights such as WO/WD/0xf0007 not present in OldSd. Microsoft documents Object Type, Object Name, OldSd/NewSd, and SDDL rights for 4670; broadening DACLs on executable or service paths supports T1222.001 File and Directory Permissions Modification. Correlate Handle ID with 4663 and Process ID with 4688.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4670
| project TimeGenerated, Computer, Account, ObjectType, ObjectName, OldSd, NewSd, ProcessName
Splunk SPL
index=wineventlog EventCode=4670 | table _time, host, Account_Name, Object_Type, Object_Name, OldSd, NewSd, Process_Name
Sample Log
EventID: 4670
Object Type: File
Object Name: C:\ProgramData\svc\agent.exe
Handle ID: 0x3f0
OldSd: D:(A;;FR;;;BU)
NewSd: D:(A;;FA;;;WD)
Process Name: C:\Windows\System32\icacls.exe

Source

Official documentationMachine-readable JSON