Skip to content
Threat Feed
Subscribe

Tag

Audit-Policy

2 briefs RSS
high advisory

Windows Audit Policy Restored via Auditpol.exe

Attackers may use auditpol.exe with the /restore argument to replace the existing audit policy with a malicious one, disabling auditing to evade detection, potentially leading to full machine compromise or lateral movement.

Splunk Enterprise +2 auditpol audit-policy defense-evasion windows
2r 1t
medium advisory

Windows Audit Policy Sub-Category Disabled

This rule identifies attempts to disable auditing for security-sensitive audit policy sub-categories on Windows systems, often employed by attackers to evade detection and forensic analysis.

Windows Security Event Logs defense-evasion windows audit-policy
2r 3t