Windows Event ID 4912 – Microsoft-Windows-Kernel-General: Object Manager Symbolic Link Creation

Start by examining the specific event details to understand which symbolic link was created and by which process.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 4912 by right-clicking the System log and selecting Filter Current Log
4. Enter 4912 in the Event IDs field and click OK
5. Double-click on a 4912 event to view detailed information including:
   • Symbolic link name and target path
   • Process ID and security context
   • Timestamp correlation with other system events

Use PowerShell to analyze multiple 4912 events and identify patterns or anomalies in symbolic link creation.

1. Open PowerShell as Administrator
2. Query recent Event ID 4912 entries:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=4912} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. For more detailed analysis, extract specific event data:

   $events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=4912} -MaxEvents 100
   $events | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ProcessId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
           SymbolicLinkName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SymbolicLinkName'} | Select-Object -ExpandProperty '#text'
           TargetName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetName'} | Select-Object -ExpandProperty '#text'
       }
   } | Format-Table -AutoSize

4. Export results for further analysis:

   $events | Export-Csv -Path "C:\Temp\Event4912_Analysis.csv" -NoTypeInformation

Cross-reference Event ID 4912 with process creation and driver loading events to understand the complete context.

1. Enable additional logging if not already active:

   wevtutil sl Microsoft-Windows-Kernel-General/Analytic /e:true

2. Query correlated events around the same timeframe:

   # Get 4912 events with surrounding context
   $startTime = (Get-Date).AddHours(-1)
   $endTime = Get-Date
   
   # Query multiple event sources
   $kernelEvents = Get-WinEvent -FilterHashtable @{
       LogName='System'
       Id=4912,7034,7035,7036
       StartTime=$startTime
       EndTime=$endTime
   } | Sort-Object TimeCreated

3. Check for driver loading events that might correlate:

   Get-WinEvent -FilterHashtable @{
       LogName='System'
       Id=219  # Driver loading events
       StartTime=$startTime
       EndTime=$endTime
   }

4. Review process creation events from Security log (if audit policy enabled):

   Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4688  # Process creation
       StartTime=$startTime
       EndTime=$endTime
   } -ErrorAction SilentlyContinue

This correlation helps identify whether symbolic link creation is part of legitimate system operations or potentially suspicious activity.

Use advanced tools to monitor the kernel object namespace and understand the impact of symbolic link creation.

1. Download and run WinObj from Microsoft Sysinternals:

   # Download WinObj (ensure you get it from official Microsoft source)
   Invoke-WebRequest -Uri "https://live.sysinternals.com/Winobj.exe" -OutFile "C:\Tools\Winobj.exe"

2. Launch WinObj to browse the kernel object namespace and locate recently created symbolic links
3. Use Process Monitor (ProcMon) to track object access patterns:

   # Download ProcMon
   Invoke-WebRequest -Uri "https://live.sysinternals.com/Procmon.exe" -OutFile "C:\Tools\Procmon.exe"

4. Configure ProcMon filters to show only object manager operations:
   • Set Process and Thread Activity to Show
   • Add filter: Operation contains CreateFile
   • Add filter: Path begins with \??\ or \Global??\
5. For programmatic monitoring, use WMI to track object creation:

   Register-WmiEvent -Query "SELECT * FROM Win32_SystemTrace WHERE EventType = 'ObjectCreate'" -Action {
       $Event = $Event.SourceEventArgs.NewEvent
       Write-Host "Object created: $($Event.ObjectName) at $($Event.TimeCreated)"
   }

Implement Event Tracing for Windows (ETW) to capture detailed kernel object manager operations including symbolic link creation.

1. Create an ETW trace session for kernel object operations:

   # Start ETW trace for Object Manager
   logman create trace "ObjectManagerTrace" -p "Microsoft-Windows-Kernel-General" 0xFFFFFFFF 0xFF -o C:\Traces\ObjectManager.etl -ets

2. Configure additional providers for comprehensive tracking:

   # Add kernel process provider
   logman update trace "ObjectManagerTrace" -p "Microsoft-Windows-Kernel-Process" 0xFFFFFFFF 0xFF -ets
   
   # Add file system provider for device access correlation
   logman update trace "ObjectManagerTrace" -p "Microsoft-Windows-Kernel-File" 0xFFFFFFFF 0xFF -ets

3. Let the trace run during the period when 4912 events occur, then stop it:

   logman stop "ObjectManagerTrace" -ets

4. Analyze the ETW trace using Windows Performance Analyzer (WPA) or convert to readable format:

   # Convert ETL to CSV for analysis
   tracerpt C:\Traces\ObjectManager.etl -o C:\Traces\ObjectManager.csv -of CSV

5. Parse the trace data for symbolic link operations:

   # PowerShell script to parse relevant events
   $traceData = Import-Csv "C:\Traces\ObjectManager.csv"
   $symbolicLinkEvents = $traceData | Where-Object {
       $_.EventName -like "*SymbolicLink*" -or 
       $_.EventName -like "*ObjectCreate*"
   } | Select-Object TimeStamp, ProcessName, EventName, Details