ADGPO-018: Audit Policy Configuration via GPO
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check parses Advanced Audit Policy Configuration from every GPO in the domain by reading the audit.csv file at \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Microsoft\Windows NT\Audit\audit.csv. For each GPO it enumerates: - Subcategory GUID and friendly name (60+ subcategories grouped under ten top-level categories: System, Logon/Logoff, Object Access, Privilege Use, Detailed Tracking, Policy Change, Account Management, DS Access, Account Logon, Global Object Access Auditing) - Inclusion Setting (Success, Failure, Success and Failure, No Auditing) - Exclusion Setting (per-user audit exclusions) - Setting Value (numeric flag: 0 No Auditing, 1 Success, 2 Failure, 3 Success and Failure) The check also reads the legacy basic audit policy from Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy (registry values under HKLM\SECURITY\Policy\PolAdtEv) and validates the Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings option, which sets HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy = 1. When SCENoApplyLegacyAuditPolicy is 0, any legacy basic audit policy GPO (audit.csv absent, OldAuditPolicy used) silently overrides the advanced audit configuration and effectively disables it. The critical-subcategory baseline that ADGPO-018 enforces: - Account Logon: Credential Validation (Success/Failure), Kerberos Authentication Service (Success/Failure), Kerberos Service Ticket Operations (Success/Failure) - Account Management: User Account Management, Computer Account Management, Security Group Management, Distribution Group Management, Application Group Management, Other Account Management Events (Success/Failure) - DS Access: Directory Service Access, Directory Service Changes (Success/Failure; Domain Controllers only) - Logon/Logoff: Logon, Logoff, Account Lockout, Special Logon, Other Logon/Logoff Events, Network Policy Server (Success/Failure) - Object Access: File System, Registry, SAM, Certification Services, Removable Storage, Filtering Platform Connection (Success/Failure where SACLs warrant it) - Policy Change: Audit Policy Change, Authentication Policy Change, Authorization Policy Change, MPSSVC Rule-Level Policy Change, Filtering Platform Policy Change (Success) - Privilege Use: Sensitive Privilege Use (Success/Failure) - System: Security State Change, Security System Extension, System Integrity, IPsec Driver, Other System Events (Success/Failure) - Detailed Tracking: Process Creation (Success), with CmdLine inclusion enabled via the ProcessCreationIncludeCmdLine_Enabled registry value The check resolves which OUs each audit-policy GPO is linked to, computes effective audit policy per OU (with link order, enforcement, and block-inheritance applied), and reports any OU that contains domain-joined computers but has no audit-policy GPO in its resultant set of policies.
Por qué importa
Audit policy is not a setting you turn on for compliance, it is the substrate every detection rule runs on. Sigma, Elastic, Microsoft Defender for Identity, Splunk, and Sentinel all assume that specific Event IDs are being generated by specific subcategories. If Credential Validation is not audited you cannot detect password spraying (4625) or Kerberoasting precursors. If Kerberos Service Ticket Operations is not audited you cannot detect Kerberoasting (4769 with RC4) or Golden Ticket use (4769 with non-existent account). If Directory Service Changes is not audited on Domain Controllers you cannot detect DCShadow, DCSync rights grants (5136 modifications to ntSecurityDescriptor), or AdminSDHolder tampering. If Process Creation is not audited with CmdLine you cannot reconstruct what attacker tooling ran, even after the fact. T1562.002 (Impair Defenses: Disable Windows Event Logging) is one of the most common defense-evasion techniques in observed intrusions precisely because audit policy can be silently downgraded by linking a new GPO with No Auditing entries or by deploying a legacy basic audit GPO when SCENoApplyLegacyAuditPolicy is not enforced. T1484.001 (Domain Policy Modification: GPO) is the upstream primitive: any actor who can edit a GPO linked above the Domain Controllers OU or the Domain Root can disable auditing forest-wide. Insufficient audit configuration is the leading cause of failed incident response. Mandiant M-Trends and other incident-response reporting consistently cite missing or incomplete Windows audit data as the top blocker to reconstructing the attack timeline.
Ruta de ataque
1. Reconnaissance: the attacker reads the current audit configuration with auditpol /get /category:* on a compromised host, or pulls every GPOs audit.csv from SYSVOL with PowerView or a direct SMB read. Subcategories set to No Auditing identify visibility gaps to exploit. 2. Visibility gap exploitation: if Kerberos Service Ticket Operations is not audited, the attacker performs Kerberoasting (Rubeus kerberoast) without generating 4769 events. If Credential Validation is not audited, password spraying against the PDC emulator produces no 4625 trail. If Directory Service Changes is not audited on DCs, the attacker grants DCSync rights to a controlled account by writing ntSecurityDescriptor on the domain head and the change leaves no 5136 record. 3. Active downgrade (T1562.002): with Edit rights on a GPO linked at or above the Domain Controllers OU, the attacker writes a new audit.csv that flips critical subcategories to No Auditing, or links a legacy basic-audit GPO when SCENoApplyLegacyAuditPolicy is 0 to override advanced audit configuration entirely. Tools: SharpGPOAbuse Add-GPOImmediateTask combined with auditpol /set /subcategory:"Credential Validation" /success:disable /failure:disable, or direct edits to the GPT in SYSVOL. 4. Per-host downgrade: on individual compromised hosts the attacker runs auditpol /clear or modifies HKLM\SECURITY\Policy\PolAdtEv directly. With SeSecurityPrivilege the attacker can also call AuthzInstallSecurityEventSource to register a benign-looking source and bury malicious events. 5. Log clearing (T1070.001): after objectives are met the attacker clears the Security log (wevtutil cl Security) to remove residual records. With audit policy already downgraded, very little needs clearing. 6. Persistence of the downgrade: because Group Policy refreshes only what is configured, the downgraded audit.csv keeps applying until a defender re-baselines. If the attacker also disables the Group Policy Client service (gpsvc) on Tier-0 hosts, even a corrective GPO will not restore auditing.
Cómo lo evalúa Guerrilla
Guerrilla enumerates every GPO via Get-GPO -All, then for each GPO reads \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Microsoft\Windows NT\Audit\audit.csv and parses the CSV columns (Machine Name, Policy Target, Subcategory, Subcategory GUID, Inclusion Setting, Exclusion Setting, Setting Value). The presence of audit.csv signals Advanced Audit Policy Configuration; its absence (combined with a non-empty {GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf with [Event Audit] entries) signals legacy basic audit policy. The check builds a per-GPO matrix of subcategory -> setting and compares it to the critical-subcategory baseline. For each domain-joined computer (or each OU containing them) it walks the GPO precedence chain (link order, enforcement, block-inheritance) to compute the effective audit policy, replicating the same precedence logic the Group Policy Client uses. The SCENoApplyLegacyAuditPolicy registry value is checked at HKLM\SYSTEM\CurrentControlSet\Control\Lsa via the Registry policy preference inside each GPO and against the default Domain Controllers Policy. The check also reads the audit log size and retention from the Security log channel configuration (HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security\MaxSize) so undersized logs that roll over before forwarding are flagged. Output identifies the offending GPO GUID, the specific subcategory, the current value, the recommended value, and the scope (which OUs are missing coverage).
Valor recomendado
Advanced Audit Policy configured via GPO with success and failure auditing for all critical categories aligned with organizational detection requirements
Remediación
Configure Advanced Audit Policy Configuration (not legacy Audit Policy) via GPO. Enable at minimum: Account Logon (Success/Failure), Account Management (Success/Failure), Directory Service Access (Success/Failure), Logon/Logoff (Success/Failure), Object Access (Success/Failure for sensitive resources), Policy Change (Success), Privilege Use (Success/Failure), and System (Success/Failure). Deploy to all domain-joined systems.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| audit-present | WARN |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AU-2, AU-3, AU-12
- MITRE ATT&CK
- T1484.001, T1562.002