Windows SecurityDetailed Tracking

Event 4695: Unprotection of auditable protected data was attempted.

Unprotection of auditable protected data was attempted.

Technical Details

Windows Security Source

Event ID: 4695

Windows Security- Detailed Tracking

Event Description

Unprotection of auditable protected data was attempted.

Key Log Fields

  • SubjectUserName - Account unprotecting data
  • SubjectDomainName - Domain of the account
  • SubjectLogonId - Logon ID for correlation
  • DataDescription - Description of data being unprotected
  • MasterKeyId - GUID of the master key used

MITRE ATT&CK® Mapping (1)

T1555credential-access
Credentials from Password Stores

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Contents