Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration

title: "Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration"
id: f683b7a4-a7cf-4d98-859d-7ab311b2b8ae
status: test
description: This rule flags Windows process creation events where secedit.exe is launched to export or modify security policy settings. Attackers can use secedit to collect policy data or reconfigure security controls to weaken or persist changes. The detection relies on process creation telemetry, matching the executable name and specific command-line flags for export (/export /cfg) or configuration (/configure /db).
references:
  - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_secedit_execution.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-11-18
modified: 2022-12-30
tags:
  - attack.collection
  - attack.discovery
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1547.001
  - attack.t1505.005
  - attack.t1556.002
  - attack.t1685
  - attack.t1574.007
  - attack.t1564.002
  - attack.t1546.008
  - attack.t1546.007
  - attack.t1547.014
  - attack.t1547.010
  - attack.t1547.002
  - attack.t1557
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \secedit.exe
    - OriginalFileName: SeCEdit
  selection_flags_discovery:
    CommandLine|contains|all:
      - /export
      - /cfg
  selection_flags_configure:
    CommandLine|contains|all:
      - /configure
      - /db
  condition: selection_img and (1 of selection_flags_*)
falsepositives:
  - Legitimate administrative use
level: medium
license: DRL-1.1
related:
  - id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
    type: derived