CmdID

CmdID / Commands

secedit

Configures and analyzes system security by comparing your current security configuration against specified security templates. Windows commands reference

On Windows 1 Sigma rule name it 6 sub-commands File secedit.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Configures and analyzes system security by comparing your current security configuration against specified security templates. NOTE: The Microsoft Management Console (MMC) and the Security Configuration and Analysis snap-in are not available on Server Core.

secedit /analyze
secedit /configure
secedit /export
secedit /generaterollback
secedit /import
secedit /validate
secedit /analyzeAllows you to analyze current systems settings against baseline settings that are stored in a database. The analysis results are stored in a separate area of the database and can be viewed in the Security Configuration and Analysis snap-in.
secedit /configureAllows you to configure a system with security settings stored in a database.
secedit /exportAllows you to export security settings stored in a database.
secedit /generaterollbackAllows you to generate a rollback template with respect to a configuration template.
secedit /importAllows you to import a security template into a database so that the settings specified in the template can be applied to a system or analyzed against a system.
secedit /validateAllows you to validate the syntax of a security template.

What detects it

Sigma process creation rules that name secedit
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe

Sub-commands

each with its page
secedit analyzesecedit configuresecedit exportsecedit generaterollbacksecedit importsecedit validate