huntrule

Windows Security 4719: Important Audit Policy Categories Disabled

Alerts on Windows Security 4719 indicating auditing was disabled for important security event subcategories.

FreeUnreviewedSigmahighv1
title: "Windows Security 4719: Important Audit Policy Categories Disabled"
id: 18f64608-a774-45a1-80cd-669872a5a270
related:
  - id: 69aeb277-f15f-4d2d-b32a-55e883609563
    type: derived
  - id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1
    type: derived
status: test
description: This rule flags Windows Security Event ID 4719 events where audit policy changes indicate removal of auditing for multiple important subcategories (e.g., Process Creation, Logon, and other security-related categories). Reducing or disabling these audit settings can help an attacker evade detection by suppressing key telemetry needed for investigations. It relies on the Security event’s SubcategoryGuid values and the presence of the success/failure removal markers in the AuditPolicyChanges field.
references:
  - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
  - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-20
modified: 2023-11-17
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  product: windows
  service: security
  definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
detection:
  selection_state_success_and_failure:
    EventID: 4719
    SubcategoryGuid:
      - "{0CCE9210-69AE-11D9-BED3-505054503030}"
      - "{0CCE9211-69AE-11D9-BED3-505054503030}"
      - "{0CCE9212-69AE-11D9-BED3-505054503030}"
      - "{0CCE9215-69AE-11D9-BED3-505054503030}"
      - "{0CCE921B-69AE-11D9-BED3-505054503030}"
      - "{0CCE922B-69AE-11D9-BED3-505054503030}"
      - "{0CCE922F-69AE-11D9-BED3-505054503030}"
      - "{0CCE9230-69AE-11D9-BED3-505054503030}"
      - "{0CCE9235-69AE-11D9-BED3-505054503030}"
      - "{0CCE9236-69AE-11D9-BED3-505054503030}"
      - "{0CCE9237-69AE-11D9-BED3-505054503030}"
      - "{0CCE923F-69AE-11D9-BED3-505054503030}"
      - "{0CCE9240-69AE-11D9-BED3-505054503030}"
      - "{0CCE9242-69AE-11D9-BED3-505054503030}"
    AuditPolicyChanges|contains:
      - "%%8448"
      - "%%8450"
  selection_state_success_only:
    EventID: 4719
    SubcategoryGuid: "{0CCE9217-69AE-11D9-BED3-505054503030}"
    AuditPolicyChanges|contains: "%%8448"
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows Security Event ID 4719 events where audit policy changes indicate removal of auditing for multiple important subcategories (e.g., Process Creation, Logon, and other security-related categories). Reducing or disabling these audit settings can help an attacker evade detection by suppressing key telemetry needed for investigations. It relies on the Security event’s SubcategoryGuid values and the presence of the success/failure removal markers in the AuditPolicyChanges field.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.