Detection rules › Splunk

Windows Audit Policy Auditing Option Modified - Registry

Author
Nasreddine Bencherchali, Bhavin Patel, Splunk
Source
upstream

The following analytic detects potentially suspicious modifications to the Audit Policy auditing options registry values. It leverages data from the Endpoint.Registry data model, focusing on changes to one of the following auditing option values "CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects" and "AuditBaseDirectories" within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. This activity is significant as it could be a sign of a threat actor trying to tamper with the audit policy configuration, and disabling SACLs configuration. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1547.014 Boot or Logon Autostart Execution: Active Setup
Privilege EscalationT1547.014 Boot or Logon Autostart Execution: Active Setup

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE Registry.registry_path="*\\Control\\Lsa*" Registry.registry_value_name IN ("AuditBaseDirectories", "AuditBaseObjects", "CrashOnAuditFail", "FullPrivilegeAuditing") BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_patheq
  • "*\\Control\\Lsa*"
Registry.registry_value_namein
  • "AuditBaseDirectories"
  • "AuditBaseObjects"
  • "CrashOnAuditFail"
  • "FullPrivilegeAuditing"