ADGPO-018: Configuración de la política de auditoría mediante GPO
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las políticas de auditoría de Windows configuradas mediante directiva de grupo determinan qué eventos de seguridad se registran en los sistemas unidos al dominio. Una configuración de auditoría insuficiente crea puntos ciegos que permiten a los atacantes operar sin ser detectados. Las categorías de auditoría clave incluyen los eventos de inicio de sesión, la gestión de cuentas, el acceso al servicio de directorio y el acceso a objetos
Por qué importa
Audit policy is not a setting you turn on for compliance, it is the substrate every detection rule runs on. Sigma, Elastic, Microsoft Defender for Identity, Splunk, and Sentinel all assume that specific Event IDs are being generated by specific subcategories. If Credential Validation is not audited you cannot detect password spraying (4625) or Kerberoasting precursors. If Kerberos Service Ticket Operations is not audited you cannot detect Kerberoasting (4769 with RC4) or Golden Ticket use (4769 with non-existent account). If Directory Service Changes is not audited on Domain Controllers you cannot detect DCShadow, DCSync rights grants (5136 modifications to ntSecurityDescriptor), or AdminSDHolder tampering. If Process Creation is not audited with CmdLine you cannot reconstruct what attacker tooling ran, even after the fact. T1562.002 (Impair Defenses: Disable Windows Event Logging) is one of the most common defense-evasion techniques in observed intrusions precisely because audit policy can be silently downgraded by linking a new GPO with No Auditing entries or by deploying a legacy basic audit GPO when SCENoApplyLegacyAuditPolicy is not enforced. T1484.001 (Domain Policy Modification: GPO) is the upstream primitive: any actor who can edit a GPO linked above the Domain Controllers OU or the Domain Root can disable auditing forest-wide. Insufficient audit configuration is the leading cause of failed incident response. Mandiant M-Trends and other incident-response reporting consistently cite missing or incomplete Windows audit data as the top blocker to reconstructing the attack timeline.
Ruta de ataque
1. Reconnaissance: the attacker reads the current audit configuration with auditpol /get /category:* on a compromised host, or pulls every GPOs audit.csv from SYSVOL with PowerView or a direct SMB read. Subcategories set to No Auditing identify visibility gaps to exploit. 2. Visibility gap exploitation: if Kerberos Service Ticket Operations is not audited, the attacker performs Kerberoasting (Rubeus kerberoast) without generating 4769 events. If Credential Validation is not audited, password spraying against the PDC emulator produces no 4625 trail. If Directory Service Changes is not audited on DCs, the attacker grants DCSync rights to a controlled account by writing ntSecurityDescriptor on the domain head and the change leaves no 5136 record. 3. Active downgrade (T1562.002): with Edit rights on a GPO linked at or above the Domain Controllers OU, the attacker writes a new audit.csv that flips critical subcategories to No Auditing, or links a legacy basic-audit GPO when SCENoApplyLegacyAuditPolicy is 0 to override advanced audit configuration entirely. Tools: SharpGPOAbuse Add-GPOImmediateTask combined with auditpol /set /subcategory:"Credential Validation" /success:disable /failure:disable, or direct edits to the GPT in SYSVOL. 4. Per-host downgrade: on individual compromised hosts the attacker runs auditpol /clear or modifies HKLM\SECURITY\Policy\PolAdtEv directly. With SeSecurityPrivilege the attacker can also call AuthzInstallSecurityEventSource to register a benign-looking source and bury malicious events. 5. Log clearing (T1070.001): after objectives are met the attacker clears the Security log (wevtutil cl Security) to remove residual records. With audit policy already downgraded, very little needs clearing. 6. Persistence of the downgrade: because Group Policy refreshes only what is configured, the downgraded audit.csv keeps applying until a defender re-baselines. If the attacker also disables the Group Policy Client service (gpsvc) on Tier-0 hosts, even a corrective GPO will not restore auditing.
Cómo lo evalúa Guerrilla
Guerrilla enumerates every GPO via Get-GPO -All, then for each GPO reads \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Microsoft\Windows NT\Audit\audit.csv and parses the CSV columns (Machine Name, Policy Target, Subcategory, Subcategory GUID, Inclusion Setting, Exclusion Setting, Setting Value). The presence of audit.csv signals Advanced Audit Policy Configuration; its absence (combined with a non-empty {GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf with [Event Audit] entries) signals legacy basic audit policy. The check builds a per-GPO matrix of subcategory -> setting and compares it to the critical-subcategory baseline. For each domain-joined computer (or each OU containing them) it walks the GPO precedence chain (link order, enforcement, block-inheritance) to compute the effective audit policy, replicating the same precedence logic the Group Policy Client uses. The SCENoApplyLegacyAuditPolicy registry value is checked at HKLM\SYSTEM\CurrentControlSet\Control\Lsa via the Registry policy preference inside each GPO and against the default Domain Controllers Policy. The check also reads the audit log size and retention from the Security log channel configuration (HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security\MaxSize) so undersized logs that roll over before forwarding are flagged. Output identifies the offending GPO GUID, the specific subcategory, the current value, the recommended value, and the scope (which OUs are missing coverage).
Valor recomendado
Política de auditoría avanzada configurada mediante GPO con auditoría de éxito y error para todas las categorías críticas, alineada con los requisitos de detección de la organización
Remediación
Configure la Configuración de directiva de auditoría avanzada (no la Directiva de auditoría heredada) mediante GPO. Habilite como mínimo: Inicio de sesión de cuenta (éxito/error), Administración de cuentas (éxito/error), Acceso al servicio de directorio (éxito/error), Inicio y cierre de sesión (éxito/error), Acceso a objetos (éxito/error para recursos sensibles), Cambio de directiva (éxito), Uso de privilegios (éxito/error) y Sistema (éxito/error). Despliegue en todos los sistemas unidos al dominio.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| audit-present | WARN |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AU-2, AU-3, AU-12
- MITRE ATT&CK
- T1484.001, T1562.002