diff --git a/yml/OSBinaries/Auditpol.yml b/yml/OSBinaries/Auditpol.yml index cac27ec..d2ae179 100644 --- a/yml/OSBinaries/Auditpol.yml +++ b/yml/OSBinaries/Auditpol.yml @@ -1,28 +1,28 @@ --- Name: Auditpol.exe -Description: a command-line tool that allows users to query and set audit policies on Windows systems. +Description: a command-line tool that allows users to query and set audit policies on Windows systems Author: 'Mahmoud Khalifa' -Created: 2024-2-24 +Created: 2024-02-24 Commands: - Command: auditpol /set /subcategory:"System Integrity" /success:disable /failure:disable - Description: Disables auditing for system integrity, which is crucial for monitoring and ensuring the integrity of security features and the operating system. - Usecase: modify the audit configuration silently and disable or alter important parameters, preventing the creation or recording of Event Logs. + Description: Disables auditing for system integrity, which is crucial for monitoring and ensuring the integrity of security features and the operating system + Usecase: Modify the audit configuration silently and disable or alter important parameters, preventing the creation or recording of Event Logs Category: Execute Privileges: Administrator MitreID: T1562.002 OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 10, Windows 11 - Command: auditpol /set /subcategory:"Logon" /success:enable /failure:enable - Description: Enables auditing for both successful and failed logon attempts. - Usecase: Use this command to monitor logon activities, which can help detect unauthorized access attempts. + Description: Enables auditing for both successful and failed logon attempts + Usecase: Use this command to monitor logon activities, which can help detect unauthorized access attempts Category: Execute Privileges: Administrator MitreID: T1562.002 - OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 10,Windows 11 + OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 10, Windows 11 Full_Path: - Path: C:\Windows\System32\auditpol.exe - Path: C:\Windows\SysWOW64\auditpol.exe Code_Sample: - - Code: + - Code: null Detection: - IOC: Unexpected changes in audit policies - IOC: auditpol.exe spawned under suspicious circumstances @@ -34,4 +34,3 @@ Resources: - Link: https://help.fortinet.com/fsiem/Public_Resource_Access/7_1_1/rules/PH_RULE_Suspicious_Auditpol_Usage.htm Acknowledgement: - Person: Mahmoud Khalifa -