Windows Event ID 4887 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Start by examining the specific details of Event ID 4887 to understand the context of the object access request.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4887 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4887 in the Event IDs field and click OK
5. Double-click on a 4887 event to view detailed information including:
   • Subject: User account requesting the handle
   • Process Information: Process ID and executable path
   • Object: Target object name and type
   • Access Request Information: Requested permissions
6. Note the Handle ID value for correlation with subsequent access events

Use PowerShell to efficiently query and analyze Event ID 4887 occurrences with specific criteria.

1. Open PowerShell as Administrator
2. Query recent 4887 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific process name:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887} | Where-Object {$_.Message -like "*notepad.exe*"} | Select-Object TimeCreated, Message

4. Search for events from a specific user account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887} | Where-Object {$_.Message -like "*S-1-5-21-*-1001*"} | Format-List TimeCreated, Message

5. Export filtered results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887; StartTime=(Get-Date).AddHours(-24)} | Export-Csv -Path "C:\Temp\Event4887_Analysis.csv" -NoTypeInformation

Ensure proper audit policy configuration to control Event ID 4887 generation and reduce noise.

1. Open Group Policy Management Console or run gpedit.msc for local policy
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access
3. Configure Audit Handle Manipulation:
   • Double-click the policy
   • Check Configure the following audit events
   • Select Success and/or Failure based on requirements
   • Click OK
4. Apply the policy using command line:

   auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:enable

5. Verify current audit settings:

   auditpol /get /subcategory:"Handle Manipulation"

6. For specific object auditing, configure SACL (System Access Control List) on target objects:

   # Example: Enable auditing on a specific folder
   icacls "C:\SensitiveData" /grant "Everyone:(OI)(CI)F" /audit "Everyone:(OI)(CI)(FA)"

Perform advanced analysis to identify suspicious patterns and correlate Event ID 4887 with other security events.

1. Create a PowerShell script to analyze access patterns:

   # Analyze 4887 events for unusual access patterns
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887; StartTime=(Get-Date).AddDays(-1)}
   $ProcessStats = $Events | ForEach-Object {
       $Message = $_.Message
       if ($Message -match "Process Name:\s+(.+)")
       {
           $Matches[1]
       }
   } | Group-Object | Sort-Object Count -Descending
   $ProcessStats | Select-Object Name, Count | Format-Table

2. Correlate with logon events (4624) to identify user context:

   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-2)}
   $HandleEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887; StartTime=(Get-Date).AddHours(-2)}
   # Cross-reference by timestamp and user SID

3. Check for failed access attempts (Event ID 4656) that might indicate reconnaissance:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656} | Where-Object {$_.Message -like "*Failure*"} | Select-Object TimeCreated, Message

4. Monitor registry access patterns for potential malware activity:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887} | Where-Object {$_.Message -like "*\Registry\*"} | Group-Object {($_.Message -split "\n" | Where-Object {$_ -like "*Object Name:*"}).Split(":")[1].Trim()}

5. Set up automated monitoring with scheduled tasks:

   # Create a monitoring script that runs every hour
   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor4887.ps1"
   $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
   Register-ScheduledTask -TaskName "Monitor Event 4887" -Action $Action -Trigger $Trigger

Conduct deep forensic analysis when Event ID 4887 indicates potential security incidents or policy violations.

1. Extract detailed event data using Windows Event Forwarding (WEF) for centralized analysis:

   # Configure WEF subscription for 4887 events
   wecutil cs "C:\Config\4887Subscription.xml"

2. Use Process Monitor (ProcMon) to correlate real-time object access with audit events:
   • Download Process Monitor from Microsoft Sysinternals
   • Set filters for the suspicious process identified in Event 4887
   • Compare ProcMon results with audit log timestamps
3. Investigate process ancestry and command line arguments:

   # Get process details from Event ID 4688 (Process Creation)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*ProcessId*"} | ForEach-Object {
       if ($_.Message -match "New Process ID:\s+0x([a-fA-F0-9]+)")
       {
           $ProcessId = [Convert]::ToInt32($Matches[1], 16)
           Write-Output "Process ID: $ProcessId"
       }
   }

4. Check for persistence mechanisms in registry locations commonly accessed:

   # Monitor common persistence registry keys
   $PersistenceKeys = @(
       "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
       "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
       "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
   )
   foreach ($Key in $PersistenceKeys) {
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887} | Where-Object {$_.Message -like "*$Key*"}
   }

5. Generate incident response report with timeline analysis:

   # Create comprehensive incident timeline
   $StartTime = (Get-Date).AddDays(-1)
   $Events = @()
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4887; StartTime=$StartTime}
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$StartTime}
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime}
   $Timeline = $Events | Sort-Object TimeCreated | Select-Object TimeCreated, Id, LevelDisplayName, @{Name="Summary";Expression={($_.Message -split "\n")[0]}}
   $Timeline | Export-Csv -Path "C:\Investigation\SecurityTimeline.csv" -NoTypeInformation