Windows: Security-sensitive audit policy sub-category disabled

Adversaries often target Windows audit policies to blind security teams and hinder incident response efforts. By disabling specific audit policy subcategories, attackers can suppress logs for critical security events, such as process creation, logon events, and security group management. This anti-forensics activity aims to evade SIEM detections and conceal post-compromise behaviors. Defenders should monitor for Windows Event ID 4719, which records changes to the system's audit policy. This brief focuses on detecting instances where a sensitive subcategory is disabled and remains in a disabled state, indicating potential malicious tampering rather than routine administrative activity.

Attack Chain

1. Attacker gains administrative access to the target host.
2. Attacker identifies critical audit policy subcategories to target (e.g., Process Creation, Logon).
3. Attacker uses command-line utilities like auditpol.exe or group policy modifications to alter audit settings.
4. System generates a Windows Event ID 4719 signifying an audit policy change.
5. If the change removes Success or Failure auditing, the attacker successfully suppresses future logs.
6. Attacker proceeds with malicious actions (e.g., lateral movement, credential theft) without generating security logs.
7. Final objective is maintained stealth during the mission duration.

Impact

Successful modification of audit policies results in critical visibility gaps for security operations centers. If security-relevant logs are disabled, incident responders cannot reconstruct the timeline of an intrusion, identify compromised accounts, or determine the scope of a breach. This enables attackers to persist within the environment undetected for extended periods.

Recommendation

• Enable Windows Security Event logging for Event ID 4719 across all workstations and servers.
• Implement the provided detection logic to alert on the removal of audit policy success logging for sensitive subcategories like "Process Creation" and "Logon".
• Investigate any account or process identified in Event ID 4719 triggers to verify if the modification was a result of authorized administrative maintenance or malicious intent.
• Maintain a baseline of intended audit policies via Group Policy or MDM to facilitate the detection of unauthorized drifts.