mdecrevoisier high experimental sigma

Audit policy disabled by command line

Detects scenarios where an attacker attempts to disbale or clear the audit policy for defense evasion purposes.

View Source

Detection Logic

{
  "selection": {
    "NewProcessName
| endswith": "\\auditpol.exe",
    "CommandLine
| contains": [
      "clear",
      "disable"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Administrator debugging audit policy

Field Validations

Loading…

Comments (0)

Loading comments...