You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Windows related audit policies that need to be implemented in order to generate the events that power our detection rules. It serves as a centralized view of the policies we use so you don't need to go through every rule to know the different audit policies required.
**Caution:** The following guides provide minimal configuration examples designed to enable specific Sysmon Event IDs. Collecting Sysmon events without a tailored configuration for your environment will cause high data volume and potentially high CPU-load, and these setup instructions require significant tuning to be production-ready.
32
+
33
+
To build an efficient and production-ready configuration, we strongly recommend exploring these community resources:
34
+
35
+
-[TrustedSec Sysmon Community Guide](https://github.com/trustedsec/SysmonCommunityGuide)
For a production-ready and more integrated solution that is designed to work with our detection rules and also provide native Endpoint Protection and Response, check out [Elastic Endpoint Security](https://www.elastic.co/security/endpoint-security).
40
+
41
+
*[Sysmon Event ID 1: Process Creation](sysmon_eventid1_process_creation.md)
42
+
*[Sysmon Event ID 2: File Creation Time Changed](sysmon_eventid2_file_creation_time_changed.md)
43
+
*[Sysmon Event ID 3: Network Connection](sysmon_eventid3_network_connection.md)
44
+
*[Sysmon Event ID 7: Image Loaded](sysmon_eventid7_image_loaded.md)
45
+
*[Sysmon Event ID 8: Create Remote Thread](sysmon_eventid8_createremotethread.md)
46
+
*[Sysmon Event ID 10: Process Accessed](sysmon_eventid10_process_access.md)
47
+
*[Sysmon Event ID 11: File Create](sysmon_eventid11_file_create.md)
Some detection rules require monitoring changes to authorization policies to detect unauthorized modifications or misconfigurations. Enabling this setting ensures visibility into changes affecting user rights and security policies, helping maintain compliance and security.
6
+
7
+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8
+
9
+
### Enable Audit Policy via Group Policy
10
+
11
+
To enable `Audit Authorization Policy Change` across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Authorization Policy Change` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
Some detection rules require monitoring computer account management events to track changes to computer accounts in the domain. Enabling this setting provides visibility into when computer accounts are created, changed, or deleted, which is crucial for detecting potential malicious activity like adding unauthorized computer accounts.
6
+
7
+
### Enable Audit Policy via Group Policy
8
+
9
+
To enable `Audit Computer Account Management` events across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Computer Account Management` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
Some detection rules require monitoring file share access to detect unauthorized access attempts or modifications. Enabling this setting helps improve security visibility and ensures compliance by tracking access to shared files and folders.
6
+
7
+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8
+
9
+
### Enable Audit Policy via Group Policy
10
+
11
+
To enable `Audit Detailed File Share` across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Detailed File Share` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12
+
13
+
```
14
+
Computer Configuration >
15
+
Policies >
16
+
Windows Settings >
17
+
Security Settings >
18
+
Advanced Audit Policies Configuration >
19
+
Audit Policies >
20
+
Object Access >
21
+
Audit Detailed File Share (Success,Failure)
22
+
```
23
+
24
+
### Enable Locally using auditpol
25
+
26
+
To enable this policy on a local machine, run the following command in an elevated command prompt:
Some detection rules require configuring audit policies to generate events when Active Directory objects are accessed. These audit policies apply exclusively to Domain Controllers, as other servers do not produce events related to Active Directory object modifications.
6
+
7
+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8
+
9
+
### Enable Audit Policy via Group Policy
10
+
11
+
To enable `Audit Directory Service Access` on all Domain Controllers via Group Policy, administrators must enable the `Audit Directory Service Access` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12
+
13
+
```
14
+
Computer Configuration >
15
+
Policies >
16
+
Windows Settings >
17
+
Security Settings >
18
+
Advanced Audit Policies Configuration >
19
+
Audit Policies >
20
+
DS Access >
21
+
Audit Directory Service Access (Success,Failure)
22
+
```
23
+
24
+
### Enable Locally using auditpol
25
+
26
+
To enable this policy on a local machine, run the following command in an elevated command prompt:
27
+
28
+
```
29
+
auditpol.exe /set /subcategory:"Directory Service Access" /success:enable /failure:enable
30
+
```
31
+
32
+
## Event IDs
33
+
34
+
When this audit policy is enabled, the following event IDs may be generated:
35
+
36
+
***4661**: A handle to an object was requested.
37
+
***4662**: An operation was performed on an object.
38
+
39
+
## Related Rules
40
+
41
+
Use the following GitHub search to identify rules that use the events listed:
0 commit comments