{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/forensic-tampering/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["windows","defense-evasion","forensic-tampering"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eAdversaries often target Windows audit policies to blind security teams and hinder incident response efforts. By disabling specific audit policy subcategories, attackers can suppress logs for critical security events, such as process creation, logon events, and security group management. This anti-forensics activity aims to evade SIEM detections and conceal post-compromise behaviors. Defenders should monitor for Windows Event ID 4719, which records changes to the system's audit policy. This brief focuses on detecting instances where a sensitive subcategory is disabled and remains in a disabled state, indicating potential malicious tampering rather than routine administrative activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains administrative access to the target host.\u003c/li\u003e\n\u003cli\u003eAttacker identifies critical audit policy subcategories to target (e.g., Process Creation, Logon).\u003c/li\u003e\n\u003cli\u003eAttacker uses command-line utilities like \u003ccode\u003eauditpol.exe\u003c/code\u003e or group policy modifications to alter audit settings.\u003c/li\u003e\n\u003cli\u003eSystem generates a Windows Event ID 4719 signifying an audit policy change.\u003c/li\u003e\n\u003cli\u003eIf the change removes Success or Failure auditing, the attacker successfully suppresses future logs.\u003c/li\u003e\n\u003cli\u003eAttacker proceeds with malicious actions (e.g., lateral movement, credential theft) without generating security logs.\u003c/li\u003e\n\u003cli\u003eFinal objective is maintained stealth during the mission duration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful modification of audit policies results in critical visibility gaps for security operations centers. If security-relevant logs are disabled, incident responders cannot reconstruct the timeline of an intrusion, identify compromised accounts, or determine the scope of a breach. This enables attackers to persist within the environment undetected for extended periods.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Windows Security Event logging for Event ID 4719 across all workstations and servers.\u003c/li\u003e\n\u003cli\u003eImplement the provided detection logic to alert on the removal of audit policy success logging for sensitive subcategories like \u0026quot;Process Creation\u0026quot; and \u0026quot;Logon\u0026quot;.\u003c/li\u003e\n\u003cli\u003eInvestigate any account or process identified in Event ID 4719 triggers to verify if the modification was a result of authorized administrative maintenance or malicious intent.\u003c/li\u003e\n\u003cli\u003eMaintain a baseline of intended audit policies via Group Policy or MDM to facilitate the detection of unauthorized drifts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T16:24:48Z","date_published":"2026-10-20T16:24:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sensitive-audit-policy-disabled/","summary":"Attackers disable security-sensitive audit policy subcategories on Windows systems to evade detection and impair forensic capabilities by preventing the logging of critical activities.","title":"Windows: Security-sensitive audit policy sub-category disabled","url":"https://feed.craftedsignal.io/briefs/2026-10-sensitive-audit-policy-disabled/"}],"language":"en","title":"CraftedSignal Threat Feed - Forensic-Tampering","version":"https://jsonfeed.org/version/1.1"}