{"id":"c6c56ada-612b-42d1-9a29-adad3c5c2c1e","title":"Audit Policy Tampering Via NT Resource Kit Auditpol","description":"Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability.\nThis can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-12-18","modified":"2023-02-21","tags":["attack.defense-impairment","attack.t1685.001"],"technique_ids":["T1685.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["The old auditpol utility isn't available by default on recent versions of Windows as it was replaced by a newer version. The FP rate should be very low except for tools that use a similar flag structure"],"references":["https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Windows%202000%20Resource%20Kit%20Tools/AuditPol"],"source_path":"rules/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml","source_sha256":"887f93bcf0c69ba6d02af492a0c3c5ccfd1e5855e71b92ee9308d4b740a00209","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Audit Policy Tampering Via NT Resource Kit Auditpol\nid: c6c56ada-612b-42d1-9a29-adad3c5c2c1e\nrelated:\n    - id: 0a13e132-651d-11eb-ae93-0242ac130002 # New auditpol version\n      type: similar\nstatus: test\ndescription: |\n    Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability.\n    This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.\nreferences:\n    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Windows%202000%20Resource%20Kit%20Tools/AuditPol\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-12-18\nmodified: 2023-02-21\ntags:\n    - attack.defense-impairment\n    - attack.t1685.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - '/logon:none'\n            - '/system:none'\n            - '/sam:none'\n            - '/privilege:none'\n            - '/object:none'\n            - '/process:none'\n            - '/policy:none'\n    condition: selection\nfalsepositives:\n    - The old auditpol utility isn't available by default on recent versions of Windows as it was replaced by a newer version. The FP rate should be very low except for tools that use a similar flag structure\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/c6c56ada-612b-42d1-9a29-adad3c5c2c1e.json","kind":"sigma"}