Windows Audit Policy Tampering Using auditpol.exe Command-Line Flags
Flags auditpol.exe executions that disable, clear, remove, or restore Windows audit policy settings.
- Product
- windows
- Category
- process_creation
- Author
- Janantha Marasinghe (https://github.com/blueteam0ps) (SigmaHQ), DRL 1.1
- Published
- 2021-02-02
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of auditpol.exe where the command line includes audit policy–impacting flags to disable, clear, remove, or restore audit policies. Such activity matters because modifying audit policy can impair visibility and detection by reducing what events are collected. The detection relies on Windows process creation telemetry capturing the executable name (including auditpol.exe) and the full command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Audit Policy Tampering Using auditpol.exe Command-Line Flags
id: dcf1c442-f3ad-43e6-a2a4-c045c7e6e5b7
related:
- id: c6c56ada-612b-42d1-9a29-adad3c5c2c1e
type: similar
- id: 0a13e132-651d-11eb-ae93-0242ac130002
type: derived
status: test
description: This rule flags process executions of auditpol.exe where the command line includes audit policy–impacting flags to disable, clear, remove, or restore audit policies. Such activity matters because modifying audit policy can impair visibility and detection by reducing what events are collected. The detection relies on Windows process creation telemetry capturing the executable name (including auditpol.exe) and the full command line.
references:
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml
author: Janantha Marasinghe (https://github.com/blueteam0ps), Huntrule Team
date: 2021-02-02
modified: 2023-02-22
tags:
- attack.defense-impairment
- attack.t1685.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \auditpol.exe
- OriginalFileName: AUDITPOL.EXE
selection_cli:
CommandLine|contains:
- disable
- clear
- remove
- restore
condition: all of selection_*
falsepositives:
- Administrator or administrator scripts might leverage the flags mentioned in the detection section. Either way, it should always be monitored
level: high
license: DRL-1.1