title: Suspicious NT Resource Kit Auditpol Usage 
id: c6c56ada-612b-42d1-9a29-adad3c5c2c1e
description: Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor. 
status: experimental
author: Nasreddine Bencherchali @nas_bench
references:
    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Windows%202000%20Resource%20Kit%20Tools/AuditPol
date: 2021/12/18
tags:
    - attack.defense_evasion
    - attack.t1562.002
level: high
logsource:
    category: process_creation
    product: windows
detection:
    selection:
      CommandLine|contains:
        - '/logon:none'
        - '/system:none'
        - '/sam:none'
        - '/privilege:none'
        - '/object:none'
        - '/process:none'
        - '/policy:none'
    condition: selection
falsepositives:
    - Unknown
