{"id":"ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1","title":"Important Windows Event Auditing Disabled","description":"Detects scenarios where system auditing for important events such as \"Process Creation\" or \"Logon\" events is disabled.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-20","modified":"2023-11-17","tags":["attack.defense-impairment","attack.t1685.001"],"technique_ids":["T1685.001"],"logsource":{"product":"windows","service":"security","definition":"dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64"},"falsepositives":["Unlikely"],"references":["https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit","https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md"],"source_path":"rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml","source_sha256":"3184184bbb09025daddaa1ce60c2e7d8a6852de4fca7538c83eb99dd4a5787cc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Important Windows Event Auditing Disabled\nid: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1\nrelated:\n    - id: 69aeb277-f15f-4d2d-b32a-55e883609563\n      type: derived\nstatus: test\ndescription: Detects scenarios where system auditing for important events such as \"Process Creation\" or \"Logon\" events is disabled.\nreferences:\n    - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit\n    - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-06-20\nmodified: 2023-11-17\ntags:\n    - attack.defense-impairment\n    - attack.t1685.001\nlogsource:\n    product: windows\n    service: security\n    definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64\ndetection:\n    selection_state_success_and_failure:\n        EventID: 4719\n        SubcategoryGuid:\n            # Note: Add or remove GUID as you see fit in your env\n            - '{0CCE9210-69AE-11D9-BED3-505054503030}' # Audit Security State Change\n            - '{0CCE9211-69AE-11D9-BED3-505054503030}' # Audit Security System Extension\n            - '{0CCE9212-69AE-11D9-BED3-505054503030}' # Audit System Integrity\n            - '{0CCE9215-69AE-11D9-BED3-505054503030}' # Audit Logon\n            - '{0CCE921B-69AE-11D9-BED3-505054503030}' # Audit Special Logon\n            - '{0CCE922B-69AE-11D9-BED3-505054503030}' # Audit Process Creation\n            - '{0CCE922F-69AE-11D9-BED3-505054503030}' # Audit Audit Policy Change\n            - '{0CCE9230-69AE-11D9-BED3-505054503030}' # Audit Authentication Policy Change\n            - '{0CCE9235-69AE-11D9-BED3-505054503030}' # Audit User Account Management\n            - '{0CCE9236-69AE-11D9-BED3-505054503030}' # Audit Computer Account Management\n            - '{0CCE9237-69AE-11D9-BED3-505054503030}' # Audit Security Group Management\n            - '{0CCE923F-69AE-11D9-BED3-505054503030}' # Audit Credential Validation\n            - '{0CCE9240-69AE-11D9-BED3-505054503030}' # Audit Kerberos Service Ticket Operations\n            - '{0CCE9242-69AE-11D9-BED3-505054503030}' # Audit Kerberos Authentication Service\n        AuditPolicyChanges|contains:\n            - '%%8448' # This is \"Success removed\"\n            - '%%8450' # This is \"Failure removed\"\n    selection_state_success_only:\n        EventID: 4719\n        SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}' # Audit Account Lockout\n        AuditPolicyChanges|contains: '%%8448'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1.json","kind":"sigma"}