Analytics Story: Windows Audit Policy Tampering

Description

Adversaries often attempt to manipulate Windows audit policies to disable or suppress logging, allowing malicious activities to go undetected. This analytic story covers groups searches that are designed to monitor and detect suspicious actions involving auditpol.exe or other methods used to modify, clear, or remove audit policy configurations.

Why it matters

Windows audit policies play a critical role in ensuring that key system activities are logged for monitoring and forensic purposes. Attackers often target audit policies by modifying, clearing, or disabling them, typically using utilities like auditpol.exe, to avoid detection during their operations. Monitoring for changes to audit policies is an industry-recognized best practice and helps uncover potential malicious activity. While legitimate administrators may occasionally modify audit policies, it is vital to track who performed the modifications, when they occurred, and the specific changes made. Unauthorized tampering with audit configurations may indicate an attempt to suppress evidence or disrupt security monitoring. This Analytic Story provides a framework to detect suspicious activities involving audit policy manipulation. It includes analytics to identify the use of auditpol.exe with specific flags (e.g., /set, /clear) and other patterns of audit tampering. These detections are critical for investigating potential breaches and maintaining the integrity of security monitoring mechanisms.

Detections

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
CrowdStrike ProcessRollup2	N/A	crowdstrike:events:sensor	crowdstrike
Sysmon EventID 1	Windows	xmlwineventlog	XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 13	Windows	xmlwineventlog	XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Windows Event Log Security 4688	Windows	xmlwineventlog	XmlWinEventLog:Security
Windows Event Log Security 4719	Windows	xmlwineventlog	XmlWinEventLog:Security

References

• https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
• https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
• https://attack.mitre.org/techniques/T1562/002/
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-clear
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-remove

Source: GitHub | Version: 1