Windows Audit Policy Tampering via auditpol.exe (disable/clear/remove/restore)

title: Windows Audit Policy Tampering via auditpol.exe (disable/clear/remove/restore)
id: dcf1c442-f3ad-43e6-a2a4-c045c7e6e5b7
related:
  - id: c6c56ada-612b-42d1-9a29-adad3c5c2c1e
    type: similar
  - id: 0a13e132-651d-11eb-ae93-0242ac130002
    type: derived
status: test
description: This rule identifies process executions of auditpol.exe where the command line contains flags consistent with changing audit policy settings, such as disable, clear, remove, or restore. Altering audit policy can directly reduce or reset system auditing, impairing detection and incident investigation. It relies on Windows process creation telemetry, specifically the image name/original filename and the command-line contents.
references:
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml
author: Janantha Marasinghe (https://github.com/blueteam0ps), Huntrule Team
date: 2021-02-02
modified: 2023-02-22
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \auditpol.exe
    - OriginalFileName: AUDITPOL.EXE
  selection_cli:
    CommandLine|contains:
      - disable
      - clear
      - remove
      - restore
  condition: all of selection_*
falsepositives:
  - Administrator or administrator scripts might leverage the flags mentioned in the detection section. Either way, it should always be monitored
level: high
license: DRL-1.1