Possible Suspicious Behavior Via SeCEdit (via process_creation)

title: Possible Suspicious Behavior Via SeCEdit (via process_creation)
id: a20373bf-a147-57c4-93dd-0227e1183fc6
status: stable
description: This rule detects potential anomalous behaviour using secedit.exe. Such as exporting or modifying the security policy
references:
    - https://attack.mitre.org/techniques/T1082/
    - https://attack.mitre.org/techniques/T1557/
    - https://attack.mitre.org/techniques/T1547/002/
    - https://attack.mitre.org/techniques/T1547/010/
    - https://attack.mitre.org/techniques/T1547/014/
    - https://attack.mitre.org/techniques/T1546/007/
    - https://attack.mitre.org/techniques/T1546/008/
    - https://attack.mitre.org/techniques/T1564/002/
    - https://attack.mitre.org/techniques/T1574/007/
    - https://attack.mitre.org/techniques/T1685/
    - https://attack.mitre.org/techniques/T1556/002/
    - https://attack.mitre.org/techniques/T1505/005/
    - https://attack.mitre.org/techniques/T1547/001/
    - https://attack.mitre.org/techniques/T1685/001/
    - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
author: Huntrule Team
date: 2026-04-08
tags:
    - attack.collection
    - attack.discovery
    - attack.persistence
    - attack.credential-access
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.defense-impairment
    - attack.t1685.001
    - attack.t1547.001
    - attack.t1505.005
    - attack.t1556.002
    - attack.t1685
    - attack.t1574.007
    - attack.t1564.002
    - attack.t1546.008
    - attack.t1546.007
    - attack.t1547.014
    - attack.t1547.010
    - attack.t1547.002
    - attack.t1557
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\secedit.exe'
        - OriginalFileName: 'SeCEdit'
    selection_flags_discovery:
        CommandLine|contains|all:
            - '/export'
            - '/cfg'
    selection_flags_configure:
        CommandLine|contains|all:
            - '/configure'
            - '/db'
    condition: selection_img and (1 of selection_flags_*)
falsepositives:
    - Unknown
level: medium