Potential Suspicious Activity Using SeCEdit
A Sigma rule for process creation on Windows, by Janantha Marasinghe.
medium 14 ATT&CK techniques 2 programs it names 3 everyday examples trip it
What it looks for
detection:
selection_flags_configure:
CommandLine|contains|all:
- '/configure'
- '/db'
selection_flags_discovery:
CommandLine|contains|all:
- '/export'
- '/cfg'
selection_img:
- Image|endswith: '\secedit.exe'
- OriginalFileName: 'SeCEdit'
condition: selection_img and (1 of selection_flags_*)
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Janantha Marasinghe, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
To incorporate changes required by the analysis process on the SecContoso.inf file, and then to direct the output to the existing file, SecAnalysisContosoFY11, without prompting, type on the page for secedit configure
secedit /configure /db C:\Security\FY11\SecDbContoso.sdb /cfg SecContoso.inf /overwrite /log C:\Security\FY11\SecAnalysisContosoFY11.xml /quietIdentifyTo export the security database and the domain security policies to an inf file, and then import that file to a different database in order to replicate the security policy settings on another computer, type on the page for secedit export
secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentifyTo export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer, type on the page for secedit import
secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg NetworkShare\Policies\SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify