Detection rules › Sigma

Audit policy enumerated

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts enumerate the audit policy in place.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1082 System Information Discovery

Event coverage

Rule body yaml

title: Audit policy enumerated
description: Detects scenarios where an attacker attempts enumerate the audit policy in place.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1070.xxx-Audit%20policy%20disabled
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-get
tags:
- attack.discovery
- attack.t1082 # System Information Discovery
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: '\auditpol.exe'
    CommandLine|contains: # full command "Auditpol.exe /get /category:* " OR "Auditpol /backup /file:C:\Audit.ini"
      - get
      - backup
  condition: selection
falsepositives:
- Administrator debugging audit policy
- Vulnerability scanners (compiance module)
- Directory monitor
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  NewProcessName|endswith: '\auditpol.exe'
  CommandLine|contains:
    - get
    - backup

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • backup corpus 6 (sigma 5, splunk 1)
  • get corpus 5 (sigma 3, splunk 1, chronicle 1)
NewProcessNameends_with
  • \auditpol.exe corpus 3 (sigma 3)