Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration
Flags secedit.exe command lines used to export or configure Windows security policy.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Janantha Marasinghe (SigmaHQ), DRL 1.1
- Published
- 2022-11-18
- Updated
- 2026-07-30
ATT&CK techniques
Execution → CollectionRecon
Resource Dev
Initial Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where secedit.exe is launched to export or modify security policy settings. Attackers can use secedit to collect policy data or reconfigure security controls to weaken or persist changes. The detection relies on process creation telemetry, matching the executable name and specific command-line flags for export (/export /cfg) or configuration (/configure /db).
Reporting behind it
- blueteamops.medium.comhttps://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_secedit_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-suspicious-secedit-exe-security-policy-export-or-config-c2c76b77
title: "Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration"
id: f683b7a4-a7cf-4d98-859d-7ab311b2b8ae
status: test
description: This rule flags Windows process creation events where secedit.exe is launched to export or modify security policy settings. Attackers can use secedit to collect policy data or reconfigure security controls to weaken or persist changes. The detection relies on process creation telemetry, matching the executable name and specific command-line flags for export (/export /cfg) or configuration (/configure /db).
references:
- https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_secedit_execution.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-11-18
modified: 2022-12-30
tags:
- attack.collection
- attack.discovery
- attack.persistence
- attack.credential-access
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.defense-impairment
- attack.t1685.001
- attack.t1547.001
- attack.t1505.005
- attack.t1556.002
- attack.t1685
- attack.t1574.007
- attack.t1564.002
- attack.t1546.008
- attack.t1546.007
- attack.t1547.014
- attack.t1547.010
- attack.t1547.002
- attack.t1557
- attack.t1082
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \secedit.exe
- OriginalFileName: SeCEdit
selection_flags_discovery:
CommandLine|contains|all:
- /export
- /cfg
selection_flags_configure:
CommandLine|contains|all:
- /configure
- /db
condition: selection_img and (1 of selection_flags_*)
falsepositives:
- Legitimate administrative use
level: medium
license: DRL-1.1
related:
- id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
type: derived