Detecting Modification Of Windows Security Audit Policy Auditpolexe
Query
DeviceRegistryEvents
| where RegistryValueData startswith "auditpol"About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1562.002 | Impair Defenses: Disable Windows Event Logging |
Author: Sergio Albea (29/10/2025)
Detecting Modification of Windows Security Audit Policy (Auditpol.exe)
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware.
Explanation
This query is designed to help detect potential security threats by monitoring changes to the Windows Security Audit Policy. Specifically, it looks for instances where the auditpol.exe command is used, which can indicate an attempt to modify security settings and impair defenses. This is important because such modifications are often a precursor to more serious attacks, like ransomware. The query filters registry events to find entries that start with "auditpol," which helps identify these potentially malicious activities early in the attack chain.
