Audit Policy Tampering Via Auditpol

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Janantha Marasinghe (https://github.com/blueteam0ps)
Source: github.com/SigmaHQ/sigma

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Known false positives

Administrator or administrator scripts might leverage the flags mentioned in the detection section. Either way, it should always be monitored

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.001` Disable or Modify Tools: Disable or Modify Windows Event Log

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Audit Policy Tampering Via Auditpol
id: 0a13e132-651d-11eb-ae93-0242ac130002
related:
    - id: c6c56ada-612b-42d1-9a29-adad3c5c2c1e # Old auditpol
      type: similar
status: test
description: |
  Threat actors can use auditpol binary to change audit policy configuration to impair detection capability.
  This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.
references:
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
author: Janantha Marasinghe (https://github.com/blueteam0ps)
date: 2021-02-02
modified: 2023-02-22
tags:
    - attack.defense-impairment
    - attack.t1685.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\auditpol.exe'
        - OriginalFileName: 'AUDITPOL.EXE'
    selection_cli:
        CommandLine|contains:
            - 'disable' # disables a specific audit policy
            - 'clear'   # delete or clears audit policy
            - 'remove'  # removes an audit policy
            - 'restore' # restores an audit policy
    condition: all of selection_*
falsepositives:
    - Administrator or administrator scripts might leverage the flags mentioned in the detection section. Either way, it should always be monitored
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\auditpol.exe'
    - OriginalFileName: 'AUDITPOL.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - 'disable'
        - 'clear'
        - 'remove'
        - 'restore'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`clear` corpus 4 (sigma 3, kusto 1) `disable` corpus 13 (sigma 10, splunk 3) `remove` corpus 4 (sigma 3, kusto 1) `restore`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\auditpol.exe` corpus 3 (sigma 3)	`field:"Image" kind:ends_with value:"\auditpol.exe"`
`OriginalFileName`	eq	`AUDITPOL.EXE` corpus 10 (splunk 8, sigma 1, elastic 1)	`field:"OriginalFileName" kind:eq value:"AUDITPOL.EXE"`