5.5 lcs.audit.key.descriptor.changed
- Event type:
lcs.audit.key.descriptor.changed - Defined in:
lcs.evman - Tier: essential
- Gating: always when the change includes the SACL; otherwise WRITE_DAC or WRITE_OWNER overlaps the alarm mask cached on the key handle
- Cardinality: once per descriptor change it covers
The record that a registry key's security descriptor was changed through a key handle, or that an attempt failed.
A change to the SACL is always recorded, whatever the handle's mask.
It takes ACCESS_SYSTEM_SECURITY, which only SeSecurityPrivilege grants,
such changes are rare, and removing a SACL is exactly how someone hides
what follows. It is recorded once the handle's own access check admits it:
a caller whose handle lacks ACCESS_SYSTEM_SECURITY is refused before any
record, so asking for a SACL change cannot be used to write records.
Owner, group and DACL changes follow the handle's mask, as writes do.
Both descriptors are recorded by length, SHA-256 digest and owner, never
in full. Whether the SACL was part of the change is
object.sd.components.
5.5.1 Fields #
| Field | Type | Presence | Meaning |
|---|---|---|---|
subject.token.sid | bin.sid | via caller | The user SID of the effective token the operation ran under. |
subject.token.integrity | uint.integrity | via caller | The integrity RID of the effective token. |
subject.token.id | uint.luid | via caller | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | via caller | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | via caller | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | via caller | The impersonation level of the effective token. |
object.kind | str.enum | required | Always key. |
object.key.guid | bin.guid | required | The registry key an operation acted on. |
object.key.path | str | required | The resolved absolute path of the registry key, in canonical form, such as Machine\System\KMES. |
object.sd.components | uint.flags | required | The parts the caller asked to change, its security_info. |
object.sd.length | uint.bytes | optional | The descriptor as written: the merge of the caller's parts into the old one. Absent when the request failed before the merge. |
object.sd.length-previous | uint.bytes | optional | Absent when the request failed before the old descriptor was read. |
object.sd.digest | bin | optional | Present with object.sd.length. |
object.sd.digest-previous | bin | optional | Present with object.sd.length-previous. |
object.sd.owner | bin.sid | optional | Present with object.sd.length. |
object.sd.owner-previous | bin.sid | optional | Present with object.sd.length-previous. |
access.requested | uint.mask | required | The rights the change needs: WRITE_OWNER for the owner or group, WRITE_DAC for the DACL, ACCESS_SYSTEM_SECURITY for the SACL. |
access.granted | uint.mask | required | The access mask in force. |
access.matched | uint.mask | required | Zero when the record exists only because the change included the SACL. |
access.audit-mask | uint.mask | required | The full continuous-audit mask cached on a handle, of which access.matched is the part this operation touched. |
transaction.id | uint | optional | The transaction the operation belonged to, registry or package. |
request.timed-out | bool | when outcome.success == false | True when the source did not answer in time, so the change may have been applied after all. |
outcome.success | bool | required | Whether the operation succeeded. |
outcome.errno | int.errno | when outcome.success == false | The error the operation failed with, as a negative errno. |
Every record also carries the header fields of the envelope, which no payload repeats.
Generated from lcs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.