{"id":"0a13e132-651d-11eb-ae93-0242ac130002","title":"Audit Policy Tampering Via Auditpol","description":"Threat actors can use auditpol binary to change audit policy configuration to impair detection capability.\nThis can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.\n","author":"Janantha Marasinghe (https://github.com/blueteam0ps)","status":"test","level":"high","date":"2021-02-02","modified":"2023-02-22","tags":["attack.defense-impairment","attack.t1685.001"],"technique_ids":["T1685.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrator or administrator scripts might leverage the flags mentioned in the detection section. Either way, it should always be monitored"],"references":["https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"],"source_path":"rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml","source_sha256":"7f8cb4a8250f361f33bec9eb5d20e83d04de438338eca2d6dc611236ba6a4152","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Audit Policy Tampering Via Auditpol\nid: 0a13e132-651d-11eb-ae93-0242ac130002\nrelated:\n    - id: c6c56ada-612b-42d1-9a29-adad3c5c2c1e # Old auditpol\n      type: similar\nstatus: test\ndescription: |\n  Threat actors can use auditpol binary to change audit policy configuration to impair detection capability.\n  This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/\nauthor: Janantha Marasinghe (https://github.com/blueteam0ps)\ndate: 2021-02-02\nmodified: 2023-02-22\ntags:\n    - attack.defense-impairment\n    - attack.t1685.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\auditpol.exe'\n        - OriginalFileName: 'AUDITPOL.EXE'\n    selection_cli:\n        CommandLine|contains:\n            - 'disable' # disables a specific audit policy\n            - 'clear'   # delete or clears audit policy\n            - 'remove'  # removes an audit policy\n            - 'restore' # restores an audit policy\n    condition: all of selection_*\nfalsepositives:\n    - Administrator or administrator scripts might leverage the flags mentioned in the detection section. Either way, it should always be monitored\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/0a13e132-651d-11eb-ae93-0242ac130002.json","kind":"sigma"}