mdecrevoisier high experimental sigma

Audit policy disabled by command line

Detects scenarios where an attacker attempts disbaled the audit policy for defense evasion purposes.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4719,
    "AuditPolicyChanges
| contains": [
      "%%8448",
      "%%8450"
    ]
  },
  "filter": {
    "SubjectUserName
| endswith": "$"
  },
  "condition": "selection and not filter"
}

False Positives

  • ⚠ Administrator debugging audit policy

Field Validations

Loading…

Comments (0)

Loading comments...