Windows Event ID 4660 – Microsoft-Windows-Security-Auditing: Object Deleted

Start by examining the specific details of Event ID 4660 to understand what was deleted and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4660 in the Event IDs field and click OK
5. Double-click on a 4660 event to view detailed information
6. Review the following key fields in the event details:
   • Subject: Shows who performed the deletion
   • Object: Contains the deleted object's SID and handle information
   • Process Information: Identifies the process that initiated the deletion
7. Note the timestamp and correlate with other security events if suspicious activity is suspected

Use PowerShell to efficiently search and analyze Event ID 4660 occurrences across multiple systems.

1. Open PowerShell as Administrator
2. Query recent 4660 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4660} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Search for deletions by a specific user account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4660} | Where-Object {$_.Message -like "*DOMAIN\username*"} | Select-Object TimeCreated, Message

4. Export events to CSV for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4660} -MaxEvents 1000 | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='User';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'}).Split(':')[1].Trim()}}, @{Name='ObjectSID';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Object > Security ID:*'}).Split(':')[1].Trim()}} | Export-Csv -Path "C:\Temp\Event4660_Analysis.csv" -NoTypeInformation

5. Query events from multiple remote systems:

   $computers = @("DC01", "DC02", "FILESERVER01")
   foreach ($computer in $computers) {
       Get-WinEvent -ComputerName $computer -FilterHashtable @{LogName='Security'; Id=4660} -MaxEvents 10 -ErrorAction SilentlyContinue
   }

Cross-reference Event ID 4660 with Active Directory Recycle Bin contents to verify legitimate deletions and potentially recover objects.

1. Enable Active Directory Recycle Bin if not already enabled (requires Windows Server 2008 R2 or later forest functional level):

   Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target (Get-ADForest).Name

2. List recently deleted objects in the Recycle Bin:

   Get-ADObject -Filter {Deleted -eq $true -and ObjectClass -eq "user"} -IncludeDeletedObjects -Properties whenChanged, DisplayName, SamAccountName | Sort-Object whenChanged -Descending

3. Find specific deleted objects by correlating SIDs from Event 4660:

   $deletedSID = "S-1-5-21-1234567890-1234567890-1234567890-1001"
   Get-ADObject -Filter {Deleted -eq $true} -IncludeDeletedObjects -Properties objectSid, whenChanged, DisplayName | Where-Object {$_.objectSid -eq $deletedSID}

4. Restore accidentally deleted objects if necessary:

   Get-ADObject -Filter {Deleted -eq $true -and DisplayName -eq "John Doe"} -IncludeDeletedObjects | Restore-ADObject

5. Generate a report of deletions with timestamps:

   $report = @()
   Get-ADObject -Filter {Deleted -eq $true} -IncludeDeletedObjects -Properties whenChanged, DisplayName, ObjectClass, LastKnownParent | ForEach-Object {
       $report += [PSCustomObject]@{
           Name = $_.DisplayName
           ObjectClass = $_.ObjectClass
           DeletedDate = $_.whenChanged
           LastLocation = $_.LastKnownParent
       }
   }
   $report | Export-Csv -Path "C:\Temp\DeletedObjects_Report.csv" -NoTypeInformation

Set up proactive monitoring to detect and alert on suspicious object deletion patterns using Windows Event Forwarding and custom PowerShell solutions.

1. Configure Windows Event Forwarding (WEF) to centralize Event ID 4660 collection:
   • On the collector server, run:

     wecutil qc

   • Create a custom subscription XML file for Event 4660:

     <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>Event4660Collection</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Collect Event ID 4660 from domain controllers</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <ConfigurationMode>Normal</ConfigurationMode>
       <Query><![CDATA[
         <QueryList>
           <Query Id="0">
             <Select Path="Security">*[System[EventID=4660]]</Select>
           </Query>
         </QueryList>
       ]]></Query>
     </Subscription>

2. Create a PowerShell monitoring script that runs as a scheduled task:

   # Monitor4660.ps1
   $threshold = 10 # Alert if more than 10 deletions in last hour
   $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4660; StartTime=(Get-Date).AddHours(-1)}
   
   if ($events.Count -gt $threshold) {
       $alertMessage = "ALERT: $($events.Count) object deletions detected in the last hour"
       Write-EventLog -LogName Application -Source "Custom Security Monitor" -EventId 9001 -EntryType Warning -Message $alertMessage
       
       # Send email alert (configure SMTP settings)
       Send-MailMessage -To "admin@company.com" -From "security@company.com" -Subject "High Volume Object Deletions Detected" -Body $alertMessage -SmtpServer "mail.company.com"
   }

3. Register the script as a scheduled task:

   $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor4660.ps1"
   $trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration ([TimeSpan]::MaxValue) -Once -At (Get-Date)
   $principal = New-ScheduledTaskPrincipal -UserID "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "Monitor Event 4660" -Action $action -Trigger $trigger -Principal $principal

4. Create custom Windows Performance Toolkit (WPT) rules for real-time monitoring:

   <!-- Save as Event4660Monitor.xml -->
   <Rules>
     <Rule Name="Object Deletion Monitor" Enabled="true">
       <EventLog>Security</EventLog>
       <EventId>4660</EventId>
       <Action Type="Alert">
         <Message>Object deleted: Check for unauthorized activity</Message>
       </Action>
     </Rule>
   </Rules>

Perform comprehensive forensic analysis when Event ID 4660 indicates potential security incidents or unauthorized object deletions.

1. Create a forensic timeline by correlating multiple event sources:

   # Collect related security events for timeline analysis
   $startTime = (Get-Date).AddDays(-7)
   $endTime = Get-Date
   
   # Gather authentication events (4624, 4625), privilege use (4672), and object access (4660, 4661, 4662)
   $forensicEvents = @(4624, 4625, 4648, 4672, 4660, 4661, 4662)
   $timeline = @()
   
   foreach ($eventId in $forensicEvents) {
       $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$eventId; StartTime=$startTime; EndTime=$endTime} -ErrorAction SilentlyContinue
       $timeline += $events
   }
   
   $timeline | Sort-Object TimeCreated | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='EventType';Expression={switch($_.Id){4624{'Logon'};4625{'Failed Logon'};4648{'Explicit Logon'};4672{'Privilege Use'};4660{'Object Deleted'};4661{'Handle Requested'};4662{'Object Accessed'};default{'Other'}}}} | Export-Csv -Path "C:\Forensics\SecurityTimeline.csv" -NoTypeInformation

2. Analyze user behavior patterns around deletion events:

   # Identify users with unusual deletion patterns
   $deletionEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4660; StartTime=(Get-Date).AddDays(-30)}
   $userDeletions = @{}
   
   foreach ($event in $deletionEvents) {
       $message = $event.Message
       $userMatch = [regex]::Match($message, 'Account Name:\s+([^\r\n]+)')
       if ($userMatch.Success) {
           $user = $userMatch.Groups[1].Value.Trim()
           if ($userDeletions.ContainsKey($user)) {
               $userDeletions[$user]++
           } else {
               $userDeletions[$user] = 1
           }
       }
   }
   
   $userDeletions.GetEnumerator() | Sort-Object Value -Descending | Select-Object @{Name='User';Expression={$_.Key}}, @{Name='DeletionCount';Expression={$_.Value}} | Export-Csv -Path "C:\Forensics\UserDeletionAnalysis.csv" -NoTypeInformation

3. Extract and preserve evidence for legal or compliance purposes:

   # Create forensic evidence package
   $evidenceDir = "C:\Forensics\Event4660_Investigation_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
   New-Item -ItemType Directory -Path $evidenceDir -Force
   
   # Export raw event logs
   wevtutil epl Security "$evidenceDir\Security_EventLog.evtx" "/q:*[System[EventID=4660]]"
   
   # Generate detailed report
   $report = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4660; StartTime=(Get-Date).AddDays(-30)} | ForEach-Object {
       $message = $_.Message
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           EventId = $_.Id
           Computer = $_.MachineName
           User = if ($message -match 'Account Name:\s+([^\r\n]+)') { $matches[1].Trim() } else { 'Unknown' }
           Domain = if ($message -match 'Account Domain:\s+([^\r\n]+)') { $matches[1].Trim() } else { 'Unknown' }
           ObjectSID = if ($message -match 'Object > Security ID:\s+([^\r\n]+)') { $matches[1].Trim() } else { 'Unknown' }
           ProcessName = if ($message -match 'Process Name:\s+([^\r\n]+)') { $matches[1].Trim() } else { 'Unknown' }
           FullMessage = $message
       }
   }
   
   $report | Export-Csv -Path "$evidenceDir\Event4660_DetailedReport.csv" -NoTypeInformation
   
   # Create hash verification file
   Get-ChildItem $evidenceDir -File | ForEach-Object {
       $hash = Get-FileHash $_.FullName -Algorithm SHA256
       "$($hash.Hash)  $($_.Name)" | Out-File -Append -FilePath "$evidenceDir\SHA256_Hashes.txt"
   }

4. Document findings and create incident response report:

   # Generate executive summary report
   $summary = @"
   Event ID 4660 Forensic Analysis Summary
   Generated: $(Get-Date)
   Analysis Period: Last 30 days
   
   Key Findings:
   - Total deletion events: $($report.Count)
   - Unique users involved: $(($report | Group-Object User).Count)
   - Peak deletion time: $(($report | Group-Object {$_.TimeCreated.Hour} | Sort-Object Count -Descending | Select-Object -First 1).Name):00
   - Most active user: $(($report | Group-Object User | Sort-Object Count -Descending | Select-Object -First 1).Name)
   
   Recommendations:
   1. Review deletion patterns for anomalies
   2. Verify all deletions were authorized
   3. Implement additional monitoring if suspicious activity detected
   4. Consider implementing approval workflows for sensitive object deletions
   "@
   
   $summary | Out-File -FilePath "$evidenceDir\Executive_Summary.txt"
   Write-Host "Forensic analysis complete. Evidence package created at: $evidenceDir" -ForegroundColor Green