huntrule

Windows Security Log Auditing Disabled via Windows Audit Policy Change (Event ID 4719)

Flags Windows Event Auditing disabled indicators from Security Event ID 4719 with removed success/failure audit policy.

FreeUnreviewedSigmalowv1
title: Windows Security Log Auditing Disabled via Windows Audit Policy Change (Event ID 4719)
id: 3d4de3e9-3785-4ecf-bdfe-97a748bcced5
related:
  - id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1
    type: derived
  - id: 69aeb277-f15f-4d2d-b32a-55e883609563
    type: derived
status: test
description: This rule identifies instances where Windows event auditing is disabled by looking for Security event log entries (Event ID 4719) that include audit policy changes removing both success and failure auditing. Attackers may use this to impair or evade detection by reducing or eliminating local event visibility. The rule relies on Windows Security log telemetry for Event ID 4719 and filters out specific Subcategory GUIDs to avoid duplicate coverage.
references:
  - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_disable_event_auditing.yml
author: "@neu5ron, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2017-11-19
modified: 2023-11-15
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  product: windows
  service: security
  definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
detection:
  selection:
    EventID: 4719
    AuditPolicyChanges|contains:
      - "%%8448"
      - "%%8450"
  filter_main_guid:
    SubcategoryGuid:
      - "{0CCE9210-69AE-11D9-BED3-505054503030}"
      - "{0CCE9211-69AE-11D9-BED3-505054503030}"
      - "{0CCE9212-69AE-11D9-BED3-505054503030}"
      - "{0CCE9215-69AE-11D9-BED3-505054503030}"
      - "{0CCE9217-69AE-11D9-BED3-505054503030}"
      - "{0CCE921B-69AE-11D9-BED3-505054503030}"
      - "{0CCE922B-69AE-11D9-BED3-505054503030}"
      - "{0CCE922F-69AE-11D9-BED3-505054503030}"
      - "{0CCE9230-69AE-11D9-BED3-505054503030}"
      - "{0CCE9235-69AE-11D9-BED3-505054503030}"
      - "{0CCE9236-69AE-11D9-BED3-505054503030}"
      - "{0CCE9237-69AE-11D9-BED3-505054503030}"
      - "{0CCE923F-69AE-11D9-BED3-505054503030}"
      - "{0CCE9240-69AE-11D9-BED3-505054503030}"
      - "{0CCE9242-69AE-11D9-BED3-505054503030}"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1

What it detects

This rule identifies instances where Windows event auditing is disabled by looking for Security event log entries (Event ID 4719) that include audit policy changes removing both success and failure auditing. Attackers may use this to impair or evade detection by reducing or eliminating local event visibility. The rule relies on Windows Security log telemetry for Event ID 4719 and filters out specific Subcategory GUIDs to avoid duplicate coverage.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.