Windows Event ID 5484 – Microsoft-Windows-Security-Auditing: A handle to an object was requested

Start by examining the specific details of Event ID 5484 to understand the context of the object access request.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5484 by right-clicking the Security log and selecting Filter Current Log
4. Enter 5484 in the Event IDs field and click OK
5. Double-click on a 5484 event to view detailed information including:
   • Subject: User account and process making the request
   • Object: Target object name and type
   • Handle ID: Unique identifier for the handle
   • Access Mask: Specific permissions requested
6. Note the Process Name and Process ID to correlate with other events
7. Check the Access Mask value to understand what permissions were requested

Use PowerShell to efficiently filter and analyze Event ID 5484 occurrences with specific criteria.

1. Open PowerShell as Administrator
2. Query recent Event ID 5484 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5484} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific process name:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5484} | Where-Object {$_.Message -like '*notepad.exe*'} | Select-Object TimeCreated, Message

4. Search for events from a specific user account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5484} | Where-Object {$_.Message -like '*DOMAIN\username*'} | Format-Table TimeCreated, Id -AutoSize

5. Export filtered results to CSV for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5484; StartTime=(Get-Date).AddHours(-24)} | Select-Object TimeCreated, Id, Message | Export-Csv -Path 'C:\temp\Event5484_Analysis.csv' -NoTypeInformation

6. Count events by process name:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5484} | ForEach-Object {($_.Message -split '\n' | Select-String 'Process Name:').ToString().Split('\t')[-1]} | Group-Object | Sort-Object Count -Descending

Adjust the object access auditing policy to control when Event ID 5484 is generated and reduce noise.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access
3. Configure Audit File System policy:
   • Double-click Audit File System
   • Check Configure the following audit events
   • Select Success and/or Failure based on requirements
   • Click OK
4. Set specific folder auditing using Advanced Security Settings:
   • Right-click the target folder and select Properties
   • Go to Security tab → Advanced → Auditing tab
   • Click Add to create new audit entry
   • Select principal (user/group) and configure access types to audit
5. Apply policy changes:

   gpupdate /force

6. Verify policy application:

   auditpol /get /subcategory:"File System"

Cross-reference Event ID 5484 with process creation events to build a complete picture of system activity.

1. Enable process creation auditing if not already configured:

   auditpol /set /subcategory:"Process Creation" /success:enable

2. Query correlated events using PowerShell:

   # Get Event ID 5484 with process details
   $ObjectAccess = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5484; StartTime=(Get-Date).AddHours(-1)}
   
   # Get Process Creation events (4688)
   $ProcessCreation = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-1)}
   
   # Correlate by Process ID
   $ObjectAccess | ForEach-Object {
       $ProcessId = ($_.Message -split '\n' | Select-String 'Process ID:').ToString().Split('\t')[-1]
       $RelatedProcess = $ProcessCreation | Where-Object {$_.Message -like "*$ProcessId*"}
       if ($RelatedProcess) {
           Write-Output "Object Access: $($_.TimeCreated) - Process: $ProcessId"
           Write-Output "Process Creation: $($RelatedProcess.TimeCreated)"
       }
   }

3. Create a timeline analysis script:

   # Timeline correlation script
   $Events = @()
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688,5484; StartTime=(Get-Date).AddHours(-2)} | Select-Object TimeCreated, Id, Message
   $Events | Sort-Object TimeCreated | Format-Table TimeCreated, Id -AutoSize

4. Check for suspicious patterns:
   • Multiple handle requests from the same process in short timeframes
   • Unusual processes accessing sensitive directories
   • Handle requests with elevated access masks from non-administrative processes
5. Export correlation data for further analysis:

   $CorrelatedEvents | Export-Csv -Path 'C:\temp\ProcessCorrelation.csv' -NoTypeInformation

Implement advanced filtering and analysis techniques to identify security-relevant Event ID 5484 patterns.

1. Create a custom PowerShell function for detailed analysis:

   function Analyze-Event5484 {
       param(
           [int]$Hours = 24,
           [string]$ProcessFilter = '*',
           [string]$ObjectFilter = '*'
       )
       
       $Events = Get-WinEvent -FilterHashtable @{
           LogName='Security'
           Id=5484
           StartTime=(Get-Date).AddHours(-$Hours)
       }
       
       $Analysis = $Events | ForEach-Object {
           $Message = $_.Message
           $ProcessName = ($Message -split '\n' | Select-String 'Process Name:').ToString().Split('\t')[-1]
           $ObjectName = ($Message -split '\n' | Select-String 'Object Name:').ToString().Split('\t')[-1]
           $AccessMask = ($Message -split '\n' | Select-String 'Access Mask:').ToString().Split('\t')[-1]
           
           [PSCustomObject]@{
               TimeCreated = $_.TimeCreated
               ProcessName = $ProcessName
               ObjectName = $ObjectName
               AccessMask = $AccessMask
               EventId = $_.Id
           }
       } | Where-Object {
           $_.ProcessName -like $ProcessFilter -and $_.ObjectName -like $ObjectFilter
       }
       
       return $Analysis
   }

2. Use the function to analyze specific patterns:

   # Analyze suspicious executable access
   $SuspiciousAccess = Analyze-Event5484 -Hours 12 -ObjectFilter '*.exe'
   $SuspiciousAccess | Group-Object ProcessName | Sort-Object Count -Descending
   
   # Check for registry access patterns
   $RegistryAccess = Analyze-Event5484 -Hours 6 -ObjectFilter '*\Registry\*'
   $RegistryAccess | Format-Table TimeCreated, ProcessName, ObjectName -AutoSize

3. Implement threshold-based alerting:

   # Alert on high-frequency access patterns
   $ThresholdEvents = Analyze-Event5484 -Hours 1
   $FrequentAccess = $ThresholdEvents | Group-Object ProcessName | Where-Object {$_.Count -gt 100}
   if ($FrequentAccess) {
       Write-Warning "High frequency object access detected from: $($FrequentAccess.Name -join ', ')"
   }

4. Set up automated monitoring with Task Scheduler:
   • Create a PowerShell script with your analysis logic
   • Use Task Scheduler to run the script at regular intervals
   • Configure email alerts or log file outputs for detected anomalies
5. Review and tune filtering rules based on baseline behavior:

   # Establish baseline patterns
   $Baseline = Analyze-Event5484 -Hours 168 | Group-Object ProcessName, ObjectName | Sort-Object Count -Descending
   $Baseline | Select-Object Name, Count | Export-Csv -Path 'C:\temp\Event5484_Baseline.csv'