Query: detection rule: Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario w
Matching passage: Sigma rule: Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario w. Logsource: windows / security. Rule: title: Windows Event Auditing Disabled id: 69aeb277-f15f-4d2d-b32a-55e883609563 related: - id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 type: derived status: test description: 'Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways. ' references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit author: '@neu5ron, Nasreddine Bencherchali (Nextron Systems)' date: 2017-11-19 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection: EventID: 4719 AuditPolicyChanges|contains: - '%%8448' - '%%8450' filter_main_guid: SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE9217-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and. Logsource: windows / process_creation. Rule: title: Potential Suspicious Windows Feature Enabled - ProcCreation id: c740d4cf-a1e9-41de-bb16-8a46a4f57918 related: - id: 55c925c1-7195-426b-a136-a9396800e29b type: similar status: test description: 'Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system - https://learn.microsoft.com/en-us/windows/wsl/install-on-server author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-29 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_cmd: CommandLine|contains|all: - Enable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: CommandLine|contains: - TelnetServer - Internet-Explorer-Optional-amd64 - TFTP - SMB1Protocol - Client-ProjFS - Microsoft-Windows-Subsystem-Linux condition: all of selection_* falsepositives: - Legitimate usage of the features listed in the rule. level: medium