Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration

ATT&CK techniques

Execution → Collection

Recon
Resource Dev
Initial Access
Execution
- T1574.007Path Interception by PATH Environment Variable
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1556.002Password Filter DLL
- T1557Adversary-in-the-Middle
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where secedit.exe is launched to export or modify security policy settings. Attackers can use secedit to collect policy data or reconfigure security controls to weaken or persist changes. The detection relies on process creation telemetry, matching the executable name and specific command-line flags for export (/export /cfg) or configuration (/configure /db).

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Suspicious Autorun Registry Persistence via sausageLoop Run Key

Suspicious Hidden Account Creation via Winlogon SpecialAccounts UserList Registry

Malicious BabyLockerKZ Run Key Persistence

Suspicious Run Key Persistence Pointing To User-Writable Path

Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)

Persistence Run Key Pointing to svchost.exe in AppData Roaming

Suspicious System Profiler Hardware Enumeration (via process_creation)

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

URL Shortcut File Created in Startup Folder for Persistence

Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration

Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-secedit-exe-security-policy-export-or-config-c2c76b77

title: "Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration"
id: f683b7a4-a7cf-4d98-859d-7ab311b2b8ae
status: test
description: This rule flags Windows process creation events where secedit.exe is launched to export or modify security policy settings. Attackers can use secedit to collect policy data or reconfigure security controls to weaken or persist changes. The detection relies on process creation telemetry, matching the executable name and specific command-line flags for export (/export /cfg) or configuration (/configure /db).
references:
  - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_secedit_execution.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-11-18
modified: 2022-12-30
tags:
  - attack.collection
  - attack.discovery
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1547.001
  - attack.t1505.005
  - attack.t1556.002
  - attack.t1685
  - attack.t1574.007
  - attack.t1564.002
  - attack.t1546.008
  - attack.t1546.007
  - attack.t1547.014
  - attack.t1547.010
  - attack.t1547.002
  - attack.t1557
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \secedit.exe
    - OriginalFileName: SeCEdit
  selection_flags_discovery:
    CommandLine|contains|all:
      - /export
      - /cfg
  selection_flags_configure:
    CommandLine|contains|all:
      - /configure
      - /db
  condition: selection_img and (1 of selection_flags_*)
falsepositives:
  - Legitimate administrative use
level: medium
license: DRL-1.1
related:
  - id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL