Detection: Windows Important Audit Policy Disabled

Updated Date: 2025-01-27 ID: 1bf500e5-1226-41d9-af5d-ed1f577929f2 Author: Nasreddine Bencherchali, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the disabling of important audit policies. It leverages EventCode 4719 from Windows Security Event Logs to identify changes where success or failure auditing is removed. This activity is significant as it suggests an attacker may have gained access to the domain controller and is attempting to evade detection by tampering with audit policies. If confirmed malicious, this could lead to severe consequences, including data theft, privilege escalation, and full network compromise. Immediate investigation is required to determine the source and intent of the change.

1`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure removed")) `important_audit_policy_subcategory_guids` 
2| replace "%%8448" with "Success removed", "%%8450" with "Failure removed", "%%8448, %%8450" with "Success removed, Failure removed" in AuditPolicyChanges 
3| eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) 
4| rename ClientProcessId as process_id 
5| stats min(_time) as _time values(host) as dest by AuditPolicyChanges SubcategoryGuid, process_id 
6| lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory 
7|  `windows_important_audit_policy_disabled_filter`

Data Source

Name Platform Sourcetype Source
Windows Event Log Security 4719 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:Security'

Macros Used

Name Value
important_audit_policy_subcategory_guids (SubcategoryGuid IN ("{0CCE922B-69AE-11D9-BED3-505054503030}", "{0CCE9215-69AE-11D9-BED3-505054503030}", "{0CCE922F-69AE-11D9-BED3-505054503030}"))
windows_important_audit_policy_disabled_filter search *
windows_important_audit_policy_disabled_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1562.001 Disable or Modify Tools Defense Evasion
Exploitation
DE.CM
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

To implement the following query, enable the audit policy sub category "Audit Audit Policy Change", and, ensure you are ingesting EventCode 4719 from your endpoints via the appropriate Splunk Add-on for Microsoft Windows. Update the macro definition with the an accurate list of Audit sub categories that you consider important for your environment.

Known False Positives

Unknown

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Important audit policy "$SubCategory$" of category "$Category$" was disabled on $dest$

Risk Object Risk Object Type Risk Score Threat Objects
dest system 60 No Threat Objects

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Security XmlWinEventLog
Integration ✅ Passing Dataset XmlWinEventLog:Security XmlWinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1