Skip to content
Threat Feed

Tag

Security Descriptor

1 brief RSS
high threat

Windows Audit Policy Security Descriptor Tampering via Auditpol

Detection of `auditpol.exe` execution with arguments to modify the audit policy security descriptor, indicative of defense evasion by adversaries aiming to limit audit logging.

Splunk Enterprise +2 auditpol security descriptor defense evasion windows
2r 1t